Securing Java Web Applications

This course shows Java web developers how to secure their applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.

Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.

Goals
  1. Generally, be prepared to develop secure Java web applications, or to secure existing applications by refactoring as necessary.
  2. Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
  3. Guard against common web attacks including XSS, CSRF, and SQL injection.
  4. Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
  5. Configure a server and/or application to use one-way or two-way HTTPS.
  6. Apply application-level cryptography where necessary.
  7. Store sensitive information securely, hash user passwords, and understand the importance of salting and of using slow hashing algorithms and processes, to maximize the safety of stored credentials.
  8. Secure log files and establish audit trails for especially sensitive information or actions.
Outline
  1. Concerns for Web Applications
    1. Threats and Attack Vectors
    2. Server, Network, and Browser Vulnerabilities
    3. Secure Design Principles
    4. GET vs. POST
    5. Container Authentication and Authorization
    6. HTML Forms
    7. Privacy Under /WEB-INF
    8. HTTP and HTTPS
    9. Other Cryptographic Practices
    10. SOA and Web Services
    11. The OWASP Top 10
  2. Authentication and Authorization
    1. HTTP BASIC and DIGEST Authentication Schemes
    2. Declaring Security Constraints
    3. User Accounts
    4. Safeguarding Credentials in Transit
    5. Replay Attacks
    6. Authorization Over URL Patterns
    7. Roles
    8. FORM Authentication
    9. Login Form Design
    10. Session Fixation
    11. Protections
    12. Programmatic Security
    13. Programmatic Security in JSF
  3. Common Web Attacks
    1. Forceful Browsing
    2. Predictable Resource Locations
    3. Using Random Numbers
    4. Cross-Site Scripting
    5. Output Escaping
    6. Cross-Site Request Forgery
    7. Synchronizer Tokens
    8. Injection Attacks
    9. Protections in JDBC and JPA
    10. Session Management
    11. Taking Care of Cookies
  4. Input Validation
    1. Validating User Input
    2. Validation Practices
    3. Regular Expressions
    4. Bean Validation (a/k/a JSR-303)
    5. Constraint Annotations
    6. Cross-Field Validation
    7. Built-In Support in Java EE
    8. Using a Validator
    9. Producing Error Responses
    10. JSF Validation
  5. HTTPS and Certificates
    1. Digital Cryptography
    2. Encryption
    3. SSL and Secure Key Exchange
    4. Hashing
    5. Signature
    6. Keystores
    7. keytool
    8. Why Keys Aren't Enough
    9. X.509 Certificates
    10. Certificate Authorities
    11. Obtaining a Signed Certificate
    12. Configuring HTTPS
    13. Client-Side Certificates and Two-Way SSL
    14. PKCS #12 and Trust Stores
    15. CLIENT-CERT Authentication
  6. Application-Level Cryptography
    1. The Java Cryptography Architecture
    2. Secure Random Number Generation
    3. The KeyStore API
    4. Digital Signature
    5. Hashing
    6. Password Hashing
    7. Why Hashing Isn't Enough
    8. Salts
    9. Key Lengthening and Key Strengthening
    10. Slow Algorithms
    11. The Java Cryptography Extensions
    12. The SecretKey and KeyGenerator Types
    13. Symmetric Encryption
    14. Choosing Algorithms and Key Sizes
    15. Dangerous Practices
    16. Storing and Managing Keys
  7. Secure Development Practices
    1. Secure Development Cycle
    2. Penetration Testing
    3. Secure Code Review
    4. Error Handling and Information Leakage
    5. Failing to a Secure Mode
    6. Designing for Failure
    7. Back Doors
    8. Logging Practices
    9. Appropriate Content for Logs
    10. Auditing Strategies
Class Materials

Each student in our Live Online and our Onsite classes receives a comprehensive set of materials, including course notes and all the class examples.

Class Prerequisites

Experience in the following is required for this Java EE class:

  • Java programming experience is essential
  • Servlets programming experience is required
  • JSP page-authoring experience is recommended but not required

Experience in the following would be useful for this Java EE class:

  • JSP page authoring.

Training for your Team

Length: 4 Days
  • Private Class for your Team
  • Online or On-location
  • Customizable
  • Expert Instructors

Training for Yourself

$2,300.00 or 4 vouchers

Upcoming Live Online Classes

  • See More Classes

Please select a class.
  • Live Online Training
  • For Individuals
  • Expert Instructors
  • Guaranteed to Run
  • 100% Free Re-take Option
  • 1-minute Video

What people say about our training

Webucator is a great way to learn. I have never tried to take a class on line before but after this experience, I will do it again. It is a great venue for learning; no travel, very personalized, and the teacher was extremely knowledgeable and made learning fun.
Michael Canny
Park Chapel Christian Church
Time well spent!!! Instructor was great!
Philippe Deray
n/a
I was the only student in the class, which was great. I was able to get one on one learning tailor fit to my needs.
Melissa Schulz
Sterling Ledet & Associates
This Intro to Excel class is exactly what I needed to be able to work with spreadsheets. The materials and instruction were excellent! The class just flew by!
Abby Abbott
IBA Molecular

No cancelation for low enrollment

Certified Microsoft Partner

Registered Education Provider (R.E.P.)

GSA schedule pricing

61,868

Students who have taken Instructor-led Training

11,794

Organizations who trust Webucator for their Instructor-led training needs

100%

Satisfaction guarantee and retake option

9.29

Students rated our trainers 9.29 out of 10 based on 28,801 reviews

Contact Us or call 1-877-932-8228