Instructor-led training

Securing Java Web Applications Training in Tuscaloosa, Alabama

Request a Training Proposal View Course Outline

What you'll learn

This course shows Java web developers how to secure their applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing. Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.

Prerequisites

Java and Servlet programming experience is required.

Course Outline

Chapter 1. Concerns for Web Applications

Threats and Attack Vectors
Server, Network, and Browser Vulnerabilities
Secure Design Principles
GET vs. POST
Container Authentication and Authorization
HTML Forms
Privacy Under /WEB-INF
HTTP and HTTPS
Other Cryptographic Practices
SOA and Web Services
The OWASP Top 10

Chapter 2. Authentication and Authorization

HTTP BASIC and DIGEST Authentication Schemes
Declaring Security Constraints
User Accounts
Safeguarding Credentials in Transit
Replay Attacks
Authorization Over URL Patterns
Roles
FORM Authentication
Login Form Design
Session Fixation
Protections
Programmatic Security
Programmatic Security in JSF

Chapter 3. Common Web Attacks

Forceful Browsing
Predictable Resource Locations
Using Random Numbers
Cross-Site Scripting
Output Escaping
Cross-Site Request Forgery
Synchronizer Tokens
Injection Attacks
Protections in JDBC and JPA
Session Management
Taking Care of Cookies

Chapter 4. Input Validation

Validating User Input
Validation Practices
Regular Expressions
Bean Validation (a/k/a JSR-303)
Constraint Annotations
Cross-Field Validation
Built-In Support in Java EE
Using a Validator
Producing Error Responses
JSF Validation

Chapter 5. HTTPS and Certificates

Digital Cryptography
Encryption
SSL and Secure Key Exchange
Hashing
Signature
Keystores
keytool
Why Keys Aren't Enough
X.509 Certificates
Certificate Authorities
Obtaining a Signed Certificate
Configuring HTTPS
Client-Side Certificates and Two-Way SSL
PKCS #12 and Trust Stores
CLIENT-CERT Authentication

Chapter 6. Application-Level Cryptography

The Java Cryptography Architecture
Secure Random Number Generation
The KeyStore API
Digital Signature
Hashing
Password Hashing
Why Hashing Isn't Enough
Salts
Key Lengthening and Key Strengthening
Slow Algorithms
The Java Cryptography Extensions
The SecretKey and KeyGenerator Types
Symmetric Encryption
Choosing Algorithms and Key Sizes
Dangerous Practices
Storing and Managing Keys

Chapter 7. Secure Development Practices

Secure Development Cycle
Penetration Testing
Secure Code Review
Error Handling and Information Leakage
Failing to a Secure Mode
Designing for Failure
Back Doors
Logging Practices
Appropriate Content for Logs
Auditing Strategies

Appendix A. Learning Resources

Training locations

Securing Java Web Applications training across the U.S. and beyond.

We provide Securing Java Web Applications training onsite and live online for organizations throughout the United States and internationally.

View all Securing Java Web Applications training locations

Ready to train your team?

Let's customize this training for your organization.

Tell us about your employees, your goals, and your preferred schedule. We'll prepare a training proposal covering scope, delivery format, and pricing.

Request a Training Proposal

or call 303.377.6176