title
Please take a moment to fill out this form. We will get back to you as soon as possible.
All fields marked with an asterisk (*) are mandatory.
Home >
Course Catalog >
Oracle >
Java >
Secure Java Web Development
Secure Java Web Development
Duration
5 Days
Course
EJSE-150
Available Formats
Classroom Training, Online Training
Course Description
Overview
This Secure Java Web Development course is designed to provide students with the ability to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.Perhaps the most eye-opening parts of the course concern common web 'hacks,' or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.
In the last part of the course we move beyond the scope of traditional, interactive web applications to consider RESTful web services, single sign-on systems, and third-party authorization. Students learn to perform HMAC cryptography as a means of HTTP message-level authentication, and get introductions and hands-on exercise with SAML SSO and OAuth.
Objectives
Upon completion of the Secure Java Web Development course, students will be able to:
- Develop secure Java web applications and services, or to secure existing applications and services by refactoring as necessary.
- Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
- Guard against common web attacks including XSS, CSRF, and SQL injection.
- Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
- Configure a server and/or application to use one-way or two-way HTTPS.
- Apply application-level cryptography where necessary.
- Store sensitive information securely, hash user passwords, and understand the importance of salting and of using slow hashing algorithms and processes, to maximize the safety of stored credentials.
- Use HMAC security as appropriate in RESTful web services.
- Participate in SAML SSO systems, and be aware of the security concerns involved in single sign-on.
- Implement server and client sides of the OAuth-2.0 initial flow in order to provide third-party authorization to resources in a secure manner.
Audience
- Experienced developers of Java EE applications
Prerequisites
- Java programming experience
- Servlets programming experience
- JSP page-authoring experience (recommended)
- Understanding RESTful web services as implemented in JAX-RS would be beneficial (recommended)
Topics
- Threats and Attack Vectors
- Server, Network, and Browser Vulnerabilities
- Secure Design Principles
- GET vs. POST
- Container Authentication and Authorization
- HTML Forms
- Privacy Under /WEB-INF
- HTTP and HTTPS
- Other Cryptographic Practices
- SOA and Web Services
- The OWASP Top 10
- HTTP BASIC and DIGEST Authentication Schemes
- Declaring Security Constraints
- User Accounts
- Safeguarding Credentials in Transit
- Replay Attacks
- Authorization Over URL Patterns
- Roles
- FORM Authentication
- Login Form Design
- Session Fixation
- Protections
- Programmatic Security
- Programmatic Security in JSF
- Forceful Browsing
- Predictable Resource Locations
- Using Random Numbers
- Cross-Site Scripting
- Output Escaping
- Cross-Site Request Forgery
- Synchronizer Tokens
- Injection Attacks
- Protections in JDBC and JPA
- Session Management
- Taking Care of Cookies
- Validating User Input
- Validation Practices
- Regular Expressions
- Bean Validation (a/k/a JSR-303)
- Constraint Annotations
- Cross-Field Validation
- Built-In Support in Java EE
- Using a Validator
- Producing Error Responses
- JSF Validation
- Digital Cryptography
- Encryption
- SSL and Secure Key Exchange
- Hashing
- Signature
- Keystores
- keytool
- Why Keys Aren't Enough
- X.509 Certificates
- Certificate Authorities
- Obtaining a Signed Certificate
- Configuring HTTPS
- Client-Side Certificates and Two-Way SSL
- PKCS #12 and Trust Stores
- CLIENT-CERT Authentication
- The Java Cryptography Architecture
- Secure Random Number Generation
- The KeyStore API
- Digital Signature
- Hashing
- Password Hashing
- Why Hashing Isn't Enough
- Salts
- Key Lengthening and Key Strengthening
- Slow Algorithms
- The Java Cryptography Extensions
- The SecretKey and KeyGenerator Types
- Symmetric Encryption
- Choosing Algorithms and Key Sizes
- Dangerous Practices
- Storing and Managing Keys
- Security Concerns for REST Services
- HTTPS
- HTTP BASIC and DIGEST
- Authorization by URL Pattern
- Cross-Site Scripting
- Injection Attacks
- Cross-Site Request Forgery
- Common Countermeasures
- Use Case: Message Authentication
- Digital Signature
- Hashing as Signature: the HMAC
- Keyed Hashing
- The Hmac Utility
- Appropriate Salts
- Canonicalization
- Amazon S3
- Timestamps
- Signing and Verifying Messages
- XML Cryptography and Canonicalization
- Canonicalizing JSON
- Use Case: Message Authentication
- Digital Signature
- Hashing as Signature: the HMAC
- Keyed Hashing
- The Hmac Utility
- Appropriate Salts
- Canonicalization
- Amazon S3
- Timestamps
- Signing and Verifying Messages
- XML Cryptography and Canonicalization
- Canonicalizing JSON
- Use Case: Message Authentication
- Digital Signature
- Hashing as Signature: the HMAC
- Keyed Hashing
- The Hmac Utility
- Appropriate Salts
- Canonicalization
- Amazon S3
- Timestamps
- Signing and Verifying Messages
- XML Cryptography and Canonicalization
- Canonicalizing JSON
Related Courses
-
Securing Java Web Applications
EJSE-145- Duration: 4 Days
- Delivery Format: Classroom Training, Online Training
- Price: 2,800.00 USD
-
Java Development for Secure Systems
EJSE-140- Duration: 3 Days
- Delivery Format: Classroom Training, Online Training
- Price: 2,100.00 USD
Self-Paced Training Info
Learn at your own pace with anytime, anywhere training
- Same in-demand topics as instructor-led public and private classes.
- Standalone learning or supplemental reinforcement.
- e-Learning content varies by course and technology.
- View the Self-Paced version of this outline and what is included in the SPVC course.
- Learn more about e-Learning
Course Added To Shopping Cart
bla
bla
bla
bla
bla
bla
Self-Paced Training Terms & Conditions
??spvc-wbt-warning??
??group-training-form-area??
??how-can-we-help-you-area??
??personalized-form-area??
??request-quote-area??
Sorry, there are no classes that meet your criteria.
Please contact us to schedule a class.
STOP! Before You Leave
Save 0% on this course!
Take advantage of our online-only offer & save 0% on any course !
Promo Code skip0 will be applied to your registration
Nothing yet
Purchase Information
??elearning-coursenumber?? ??coursename??
View Cart