This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Talk:OWASP Java Project Roadmap"
(→Input Validation) |
|||
| Line 19: | Line 19: | ||
==J2EE Security for Developers== | ==J2EE Security for Developers== | ||
| + | ===Java Security Basics=== --[[User:Stephendv|Stephendv]] 08:11, 12 June 2006 (EDT) | ||
| + | * Class Loading | ||
| + | * Bytecode verifier | ||
| + | * The Security Manager | ||
| + | * Building a security policy | ||
===Input Validation=== | ===Input Validation=== | ||
* Overview | * Overview | ||
| Line 29: | Line 34: | ||
** Hibernate | ** Hibernate | ||
** Ibatis | ** Ibatis | ||
| − | ** Spring JDBC | + | ** Spring JDBC --[[User:Stephendv|Stephendv]] 08:11, 12 June 2006 (EDT) |
** EJB 3.0? --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | ** EJB 3.0? --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | ||
** JDO? --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | ** JDO? --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | ||
| Line 47: | Line 52: | ||
* Misc I/P Validation Attacks (e.g. HTTP Response Splitting) | * Misc I/P Validation Attacks (e.g. HTTP Response Splitting) | ||
* Using struts (Would recommend we cover a number of frameworks as mentioned above). --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | * Using struts (Would recommend we cover a number of frameworks as mentioned above). --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT) | ||
| − | + | ||
=== Authentication=== | === Authentication=== | ||
* SSL Best Practices | * SSL Best Practices | ||
Revision as of 12:11, 12 June 2006
J2EE Security for Architects
- Risk Analysis
To my mind, Risk Analysis is a general exercise that will apply equaly to all apps irrespective of the language used to implement the app. So would say that this belongs in the Guide rather than the Java project, unless you have some ideas on how to make this Java specific? --Stephendv 08:04, 12 June 2006 (EDT)
- Mapping Regulatory requirements to technical requirements
Same as above. --Stephendv 08:04, 12 June 2006 (EDT)
- Design considerations
This is quite general. Shall we narrow it down to the architectural issues that should be considered for each of the popular architectures such as:
- Architectural considerations
- EJB Middle tier
- Web Services Middle tier
- Spring Middle tier
--Stephendv 08:04, 12 June 2006 (EDT)
- Frameworks you should be aware of (e.g. struts, stinger, etc.)
There are many frameworks out there, so I'd suggest we keep this down to frameworks that specifically offer security functionality such as:
- Acegi
- Commons validator
- Stinger seems to be parked for a while now, is this correct Jeff?
Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section. --Stephendv 08:04, 12 June 2006 (EDT)
J2EE Security for Developers
===Java Security Basics=== --Stephendv 08:11, 12 June 2006 (EDT)
- Class Loading
- Bytecode verifier
- The Security Manager
- Building a security policy
Input Validation
- Overview
SQL Injection
- Overview
- Prevention
XSS
- Overview
- Prevention
- White Listing
- Manual HTML Encoding
- Preventing XSS in popular Web Frameworks
- JSP
- Struts
- Spring MVC
- Java Server Faces
- WebWork
- Wicket
- Tapestry --Stephendv 08:04, 12 June 2006 (EDT)
- Misc I/P Validation Attacks (e.g. HTTP Response Splitting)
- Using struts (Would recommend we cover a number of frameworks as mentioned above). --Stephendv 08:04, 12 June 2006 (EDT)
Authentication
- SSL Best Practices
- SQL Injection. Why discuss this here, when it's an input validation issue? --Stephendv 08:04, 12 June 2006 (EDT)
- Session Fixation
- Captcha systems --Stephendv 08:04, 12 June 2006 (EDT)
Authorization
- Declarative v/s Programmatic
- web.xml configuration
- Forceful browsing. Could you expand on this? --Stephendv 08:04, 12 June 2006 (EDT)
- JAAS
Encryption
- JCE
- Storing db secrets
- Encrypting JDBC connections
Error Handling & Logging
- Output Validation
- Custom Errors
- Logging - why log? what to log? log4j, etc.
Deployment Issues
- Need to add here
