Instructor-led training

Spring Framework Security

This in-depth course introduces the Java web developer to the Spring Security framework.

Request a Training Proposal View Course Outline

What you'll learn

This in-depth course introduces the Java web developer to the Spring Security framework. We start with an overview and practical exercises in basic usage: XML configuration for authentication and URL-based authorization. Then we start to dig into Spring Security as a Java model, and develop advanced techniques including custom user realms, custom authorization constraints, method-based authorization, and instance-based authorization. We then explore two increasingly popular extensions to Spring Security. We consider the Security Assertions Markup Language, or SAML, and the wide range of identity and security features it offers -- but quickly focus on it's support for single sign-on (SSO), and learn how the Spring Security SAML Extension enables applications to interact with SAML identity providers to implement SSO and single logout. And we look at OAuth for Spring Security, which enables third-party authorization scenarios, and learn how to implement both the server and client sides of the OAuth 2.0 flow.

Prerequisites

Java, in particular Servlet, programming experience is essential.

Course Outline

Chapter 1. Secure Web Applications

Threats and Attack Vectors
Server, Network, and Browser Vulnerabilities
Secure Design Principles
GET vs. POST
Container Authentication and Authorization
HTML Forms
Privacy Under /WEB-INF
HTTP and HTTPS
Other Cryptographic Practices
SOA and Web Services
The OWASP Top 10

Chapter 2. Authentication and Authorization

HTTP BASIC and DIGEST Authentication Schemes
Declaring Security Constraints
User Accounts
Safeguarding Credentials in Transit
Replay Attacks
Authorization Over URL Patterns
Roles
FORM Authentication
Login Form Design
EJB Authorization
Programmatic Security
Programmatic Security in JSF

Chapter 3. Secure Application Design

Single Points of Decision
Cross-Site Scripting
Validation vs. Output Escaping
Forceful Browsing
Cross-Site Request Forgery
Request Tokens
Injection Attacks
Protections in JDBC and JPA
Session Management
Taking Care of Cookies
Validating User Input
Validation Practices
Regular Expressions
JSF Validation

Chapter 4. HTTPS and Certificates

Digital Cryptography
Encryption
SSL and Secure Key Exchange
Hashing
Signature
Keystores
keytool
Why Keys Aren't Enough
X.509 Certificates
Certificate Authorities
Obtaining a Signed Certificate
Configuring HTTPS
Client-Side Certificates and Two-Way SSL
PKCS #12 and Trust Stores
CLIENT-CERT Authentication

Chapter 5. Application-Level Cryptography

The Java Cryptography Architecture
Secure Random Number Generation
The KeyStore API
The Signature Class
The SignedObject Class
The MessageDigest Class
The Java Cryptography Extensions
The SecretKey and KeyGenerator Types
The Cipher Class
Choosing Algorithms and Key Sizes
Dangerous Practices

Chapter 6. Secure Development Practices

Secure Development Cycle
Error Handling and Information Leakage
Failing to a Secure Mode
Logging Practices
Appropriate Content for Logs
Auditing
Strategies: Filters, Interceptors, and Command Chains
Penetration Testing
Back Doors

Appendix A. Learning Resources

Training locations