Spring Framework Security Training

Answers to Popular Questions:

 
Yes, this class can be tailored to meet your specific training needs.
Yes, we provide Java Programming consulting services.
Yes, group discounts are provided.

Course Description

 
This in-depth course introduces the Java web developer to the Spring Security framework. We start with an overview and practical exercises in basic usage: XML configuration for authentication and URL-based authorization. Then we start to dig into Spring Security as a Java model, and develop advanced techniques including custom user realms, custom authorization constraints, method-based authorization, and instance-based authorization. We then explore two increasingly popular extensions to Spring Security. We consider the Security Assertions Markup Language, or SAML, and the wide range of identity and security features it offers -- but quickly focus on it's support for single sign-on (SSO), and learn how the Spring Security SAML Extension enables applications to interact with SAML identity providers to implement SSO and single logout. And we look at OAuth for Spring Security, which enables third-party authorization scenarios, and learn how to implement both the server and client sides of the OAuth 2.0 flow.
Course Length: 3 Days
Course Tuition: $1090 (US)

Prerequisites

Java, in particular Servlet, programming experience is essential.

Course Outline

 

Chapter 1. Secure Web Applications

  • Threats and Attack Vectors
  • Server, Network, and Browser Vulnerabilities
  • Secure Design Principles
  • GET vs. POST
  • Container Authentication and Authorization
  • HTML Forms
  • Privacy Under /WEB-INF
  • HTTP and HTTPS
  • Other Cryptographic Practices
  • SOA and Web Services
  • The OWASP Top 10

Chapter 2. Authentication and Authorization

  • HTTP BASIC and DIGEST Authentication Schemes
  • Declaring Security Constraints
  • User Accounts
  • Safeguarding Credentials in Transit
  • Replay Attacks
  • Authorization Over URL Patterns
  • Roles
  • FORM Authentication
  • Login Form Design
  • EJB Authorization
  • Programmatic Security
  • Programmatic Security in JSF

Chapter 3. Secure Application Design

  • Single Points of Decision
  • Cross-Site Scripting
  • Validation vs. Output Escaping
  • Forceful Browsing
  • Cross-Site Request Forgery
  • Request Tokens
  • Injection Attacks
  • Protections in JDBC and JPA
  • Session Management
  • Taking Care of Cookies
  • Validating User Input
  • Validation Practices
  • Regular Expressions
  • JSF Validation

Chapter 4. HTTPS and Certificates

  • Digital Cryptography
  • Encryption
  • SSL and Secure Key Exchange
  • Hashing
  • Signature
  • Keystores
  • keytool
  • Why Keys Aren't Enough
  • X.509 Certificates
  • Certificate Authorities
  • Obtaining a Signed Certificate
  • Configuring HTTPS
  • Client-Side Certificates and Two-Way SSL
  • PKCS #12 and Trust Stores
  • CLIENT-CERT Authentication

Chapter 5. Application-Level Cryptography

  • The Java Cryptography Architecture
  • Secure Random Number Generation
  • The KeyStore API
  • The Signature Class
  • The SignedObject Class
  • The MessageDigest Class
  • The Java Cryptography Extensions
  • The SecretKey and KeyGenerator Types
  • The Cipher Class
  • Choosing Algorithms and Key Sizes
  • Dangerous Practices

Chapter 6. Secure Development Practices

  • Secure Development Cycle
  • Error Handling and Information Leakage
  • Failing to a Secure Mode
  • Logging Practices
  • Appropriate Content for Logs
  • Auditing
  • Strategies: Filters, Interceptors, and Command Chains
  • Penetration Testing
  • Back Doors

Appendix A. Learning Resources

Course Directory [training on all levels]

Upcoming Classes