Secure Java Web Development

Course Number:

NTXJVA310

Audience:

Course Duration:
5 days

Prerequisites:

Java web programming experience is essential.  Understanding request/response cycle and RESTful fundamentals is highly recommended.

Course Objectives:
  • Generally, be prepared to develop secure Java web applications and services, or to secure existing applications and services by refactoring as necessary.
  • Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
  • Guard against common web attacks including XSS, CSRF, and SQL injection.
  • Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
  • Configure a server and/or application to use one-way or two-way HTTPS.
  • Apply application-level cryptography where necessary.
  • Store sensitive information securely, hash user passwords, and understand the importance of salting and of using slow hashing algorithms and processes, to maximize the safety of stored credentials.
  • Use HMAC security as appropriate in RESTful web services.
  • Participate in SAML SSO systems, and be aware of the security concerns involved in single sign-on.
  • Implement server and client sides of the OAuth-2.0 initial flow in order to provide third-party authorization to resources in a secure manner.
Course Outline:
  • Concerns for Web Applications
    • Threats and Attack Vectors
    • Server, Network, and Browser Vulnerabilities
    • Secure Design Principles
    • GET vs. POST
    • Container Authentication and Authorization
    • HTML Forms
    • Privacy Under /WEB-INF
    • HTTP and HTTPS
    • Other Cryptographic Practices
    • SOA and Web Services
    • The OWASP Top 10
  • Authentication and Authorization
    • HTTP BASIC and DIGEST Authentication Schemes
    • Declaring Security Constraints
    • User Accounts
    • Safeguarding Credentials in Transit
    • Replay Attacks
    • Authorization Over URL Patterns
    • Roles
    • FORM Authentication
    • Login Form Design
    • EJB Authorization
    • Programmatic Security
    • Programmatic Security in JSF
  • Common Web Attacks
    • Forceful Browsing
    • Predictable Resource Locations
    • Using Random Numbers
    • Cross-Site Scripting
    • Output Escaping
    • Cross-Site Request Forgery
    • Synchronizer Tokens
    • Injection Attacks
    • Protections in JDBC and JPA
    • Session Management
    • Taking Care of Cookies
  • Input Validation
    • Validating User Input
    • Validation Practices
    • Regular Expressions
    • Bean Validation (a/k/a JSR-303)
    • Constraint Annotations
    • Cross-Field Validation
    • Built-In Support in Java EE
    • Using a Validator
    • Producing Error Responses
    • JSF Validation
  • HTTPS and Certificates
    • Digital Cryptography
    • Encryption
    • SSL and Secure Key Exchange
    • Hashing
    • Signature
    • Keystores
    • keytool
    • Why Keys Aren’t Enough
    • X.509 Certificates
    • Certificate Authorities
    • Obtaining a Signed Certificate
    • Configuring HTTPS
    • Client-Side Certificates and Two-Way SSL
    • PKCS #12 and Trust Stores
    • CLIENT-CERT Authentication
  • Application-Level Cryptography
    • The Java Cryptography Architecture
    • Secure Random Number Generation
    • The KeyStore API
    • Digital Signature
    • Hashing
    • Password Hashing
    • Why Hashing Isn’t Enough
    • Salts
    • Key Lengthening and Key Strengthening
    • Slow Algorithms
    • The Java Cryptography Extensions
    • The SecretKey and KeyGenerator Types
    • Symmetric Encryption
    • Choosing Algorithms and Key Sizes
    • Dangerous Practices
    • Storing and Managing Keys
  • REST Security Basics
    • HMAC Sec Security Concerns for REST Services
    • HTTPS
    • HTTP BASIC and DIGEST
    • Authorization by URL Pattern
    • Cross-Site Scripting
    • Injection Attacks
    • Cross-Site Request Forgery
    • Common Countermeasures
  • HMAC Security
    • Use Case: Message Authentication
    • Digital Signature
    • Hashing as Signature: the HMAC
    • Keyed Hashing
    • The Hmac Utility
    • Appropriate Salts
    • Canonicalization
    • Amazon S3
    • Timestamps
    • Signing and Verifying Messages
    • XML Cryptography and Canonicalization
    • Canonicalizing JSON
  • SAML SSO
    • The Challenge of Single Sign-On
    • Federated Identity
    • SAML 2.0
    • The Web Browser SSO Profile
    • Identity Providers and Service Providers
    • SAML Assertions
    • SAML Protocol
    • SAML Bindings
    • Speaking “Through” the Browser
    • The HTTP Redirect Binding
    • Artifact and SOAP Bindings
    • SAML Attributes
    • Security Concerns in SSO Systems
  • OAUTH
    • Use Case: Third-Party Authorization
    • OAuth
    • Initial Flow
    • Grant Types
    • Access Tokens
    • The Google OAuth API
    • Implementing Authorization and Resource Servers
    • Implementing Clients
    • Security Concerns with OAuth

Related Posts

About Us
Ntier company logo

IT Training, Agile Ways of Working and High Impact Talent Development Strategies

Let Us Come to You!

Classes recently delivered in: Atlanta, Boston, Chicago, Columbus, Dallas, Detroit, Indianapolis, Jerusalem, London, Milan, New York, Palo Alto, Phoenix, Pittsburgh, Portland, Raleigh, San Antonio, San Diego, San Francisco, San Jose, Seattle, Springfield, Mass., St. Louis, Tampa and more!