The JavaScript class gave me exactly what I need to advance my understanding and skills. I would tot... More Testimonials »

Securing Java Web Applications

Delivery Options

Class Description

Class Overview

This advanced course shows experienced developers of Java web applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.

Class Goals

  • Generally, be prepared to develop secure Java web applications, or to secure existing applications by refactoring as necessary.
  • Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
  • Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
  • Configure a server and/or application to use one-way or two-way HTTPS.
  • Apply application-level cryptography where necessary.
  • Secure log files and establish audit trails for especially sensitive information or actions.

Class Outline

  1. Secure Web Applications
    1. Threats and Attack Vectors
    2. Server, Network, and Browser Vulnerabilities
    3. Secure Design Principles
    4. GET vs. POST
    5. Container Authentication and Authorization
    6. HTML Forms
    7. Privacy Under /WEB-INF
    8. HTTP and HTTPS
    9. Other Cryptographic Practices
    10. SOA and Web Services
    11. The OWASP Top 10
  2. Authentication and Authorization
    1. HTTP BASIC and DIGEST Authentication Schemes
    2. Declaring Security Constraints
    3. User Accounts
    4. Safeguarding Credentials in Transit
    5. Replay Attacks
    6. Authorization Over URL Patterns
    7. Roles
    8. FORM Authentication
    9. Login Form Design
    10. EJB Authorization
    11. Programmatic Security
    12. Programmatic Security in JSF
  3. Secure Application Design
    1. Single Points of Decision
    2. Cross-Site Scripting
    3. Validation vs. Output Escaping
    4. Forceful Browsing
    5. Cross-Site Request Forgery
    6. Request Tokens
    7. Injection Attacks
    8. Protections in JDBC and JPA
    9. Session Management
    10. Taking Care of Cookies
    11. Validating User Input
    12. Validation Practices
    13. Regular Expressions
    14. JSF Validation
  4. HTTPS and Certificates
    1. Digital Cryptography
    2. Encryption
    3. SSL and Secure Key Exchange
    4. Hashing
    5. Signature
    6. Keystores
    7. keytool
    8. Why Keys Aren't Enough
    9. X.509 Certificates
    10. Certificate Authorities
    11. Obtaining a Signed Certificate
    12. Configuring HTTPS
    13. Client-Side Certificates and Two-Way SSL
    14. PKCS #12 and Trust Stores
    15. CLIENT-CERT Authentication
  5. Application-Level Cryptography
    1. The Java Cryptography Architecture
    2. Secure Random Number Generation
    3. The KeyStore API
    4. The Signature Class
    5. The SignedObject Class
    6. The MessageDigest Class
    7. The Java Cryptography Extensions
    8. The SecretKey and KeyGenerator Types
    9. The Cipher Class
    10. Choosing Algorithms and Key Sizes
    11. Dangerous Practices
  6. Secure Development Practices
    1. Secure Development Cycle
    2. Error Handling and Information Leakage
    3. Failing to a Secure Mode
    4. Logging Practices
    5. Appropriate Content for Logs
    6. Auditing
    7. Strategies: Filters, Interceptors, and Command Chains
    8. Penetration Testing
    9. Back Doors

Class Materials

All students receive a course manual or book and all the class examples.

Students in private onsite classes will also receive:

Class Prerequisites

Experience in the following areas is required:

  • Java programming experience is essential
  • Servlets programming experience is required
  • JSP page-authoring experience is recommended but not required

Technical Requirements

Our computer technical requirements and setup process is easy, with support just a click away.


  • Java ®, all Java-based marks, Hibernate ®, and all Hibernate-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. or its subsidiaries in the U.S. and other countries.
Client Success
  1. Independent Survey
  2. Client List
  3. Testimonials
Join The Team
  1. Learn how you can become a Webucator Trainer
  2. Career Opportunities
Training Classes
Locations
Live eLearning

Like a class you would go to, but you don't have to go anywhere. More...

Customized Onsite Training

The trainer comes to you and delivers a class customized for your team. More...

Self-Paced eLearning

Our least expensive option. You proceed through the course entirely at your own pace. More...

Reference Library
Partner Programs
© Webucator, Inc. All rights reserved. | Toll Free: 877-932-8228 | UK: 0808-101-3484 | From outside the USA: 315-849-2724| Fax: 315-849-2723