Difference between revisions of "Category:OWASP Enterprise Security API"

OWASP Tools Project

Enterprise Security API (ESAPI)

OWASP Enterprise Security API Toolkits help software developers guard against security-related design and implementation flaws. Just as web applications and web services can be Public Key Infrastructure (PKI) enabled (PK-enabled) to perform for example certificate-based authentication, applications and services can be OWASP ESAPI-enabled (ES-enabled) to enable applications and services to protect themselves from attackers. Further development of ESAPI occurs through mailing list discussions and occasional workshops, and suggestions for improvement are welcome. For more information, please contact us.

ESAPI Toolkits

Java EE
.NET
Classic ASP
PHP
ColdFusion & CFML
Python
Haskell

How ESAPI Works

ESAPI Toolkits are designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

Latest News

• ESAPI Java 2.0preview1 has been released
• ESAPI Python version project is starting up. Please contact [email protected] for more information.
• The Cold Fusion implementation project has started. It will build on the Java API, using wrappers for CFML.
• ESAPI has been through a line-by-line review by a major systems integrator. We will post all the findings soon but they are pretty minor.
• Request for users/adopters/supporters. Please let us know your stories!
• ESAPI News Archives
• ESAPI Mailing List

Sample Application - ESAPI Swingset

• The ESAPI Swingset sample application is under development.
  • Many lessons have been completed that demonstrate how to leverage ESAPI to protect a web application.
  • It also demonstrates the flaws web applications can have if they are not ESAPI-enabled.

Project Leader
Jeff Williams

Project Contributors
Jim Manico
Dave Wichers
Arshan Dabirsiaghi
Jerry Hoff
Chris Schmidt
Kevin W. Wall

The ESAPI project is sponsored by:

Users and Adopters

The following organizations are a few of the many organizations that are starting to adopt ESAPI to secure their web applications:

• American Express
• Apache Foundation
• Booz Allen Hamilton
• Aspect Security
• Galois
• Foundstone(McAfee)
• The Hartford
• Infinite Campus
• Lockheed Martin
• MITRE
• Nationwide Insurance
• U.S. Navy - SPAWAR
• The World Bank
• SANS Institute

Please let us know how your organization is using OWASP ESAPI. Include your name, organization's name, and brief description of how you are using it. The project lead can be reached here.