Download as PDF, PPTX
Uploaded byMatt Raible
Web App Security for Java Developers - UberConf 2021
The document presents an overview of web app security specifically for Java developers, emphasizing seven essential strategies to enhance application security. Key recommendations include using HTTPS, scanning dependencies, keeping software up-to-date, securing secrets, implementing content security policies, utilizing OAuth 2.0 and OIDC, and preventing CSRF attacks. The author provides practical tips and coding examples for implementing these strategies using various frameworks such as Spring Boot and Angular.
Web App Security for Java Developers - UberConf 2021
- 1. Matt Raible |@mraible October 8, 2021 Web App Security for Java Developers Photo by Michiel Leunens on https://unsplash.com/photos/fBB7FeS4Xas
- 2. @mraible Who is MattRaible? Father, Husband, Skier, Mountain Biker, Whitewater Rafter Bus Lover Web Developer and Java Champion Okta Developer Advocate Blogger on raibledesigns.com and developer.okta.com/blog @mraible
- 6.
- 7. @mraible Today’s Agenda What isweb app security? 7 simple ways to better app security 3 quick demos 🍃 Spring Boot 🅰 Angular 🤓 JHipster
- 8. What is webapp security?
- 9. 1. Use HTTPS 2.Scan your dependencies 3. Use the latest releases 4. Secure your secrets 7 Simple Ways to Better Web App Security 5. Use a Content Security Policy 6. Use OAuth 2.0 and OIDC 7. Prevent Cross-site request forgery (CSRF)
- 10. @mraible 1. Use HTTPSEverywhere! Let’s Encrypt offers free HTTPS certificates certbot can be used to generate certificates mkcert can be used to create localhost certificates Spring Boot Starter ACME for automating certificates
- 11.
- 12.
- 13. HTTPS for StaticSites too! https://www.troyhunt.com/heres-why-your-static-website-needs-https
- 14.
- 15. Force HTTPS inSpring Boot @Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel().anyRequest().requiresSecure(); } }
- 16. Force HTTPS inthe Cloud @Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel() .requestMatchers(r - > r.getHeader("X-Forwarded-Proto") ! = null) .requiresSecure(); } }
- 17. Force HTTPS inSpring WebFlux @EnableWebFluxSecurity public class SecurityConfiguration { @Bean SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http.redirectToHttps(withDefaults()); return http.build(); } }
- 18. Force HTTPS inSpring WebFlux + Cloud @EnableWebFluxSecurity public class SecurityConfiguration { @Bean SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http.redirectToHttps(redirect - > redirect .httpsRedirectWhen(e - > e.getRequest().getHeaders().containsKey("X-Forwarded-Proto")) ); return http.build(); } }
- 19. @mraible “Why do weneed HTTPS inside our network?”
- 20. @mraible 2. Scan YourDependencies
- 21.
- 22.
- 23. 3. Use theLatest Releases
- 24. How well doyou know your dependencies? Dependency Health Indirect Dependencies Regular Releases Regular commits Dependencies
- 25. Check for Updateswith npm npm i -g npm-check-updates ncu
- 26. Check for Updateswith Maven mvn versions:display-dependency-updates https://www.mojohaus.org/versions-maven-plugin
- 27. Check for Updateswith Gradle plugins { id("se.patrikerdes.use-latest-versions") version "0.2.17" id("com.github.ben-manes.versions") version “0.39.0" . . . } $ ./gradlew useLatestVersions https://github.com/patrikerdes/gradle-use-latest-versions-plugin
- 28. @mraible 4. Secure YourSecrets
- 29. HashiCorp Vault andAzure Key Vault
- 30. https://developer.okta.com/blog/2020/05/04/spring-vault Secure Secrets WithSpring Cloud Config and Vault
- 31. 5. Use aContent Security Policy
- 32. Default Spring SecurityHeaders Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY X-XSS-Protection: 1; mode=block
- 33. Add a ContentSecurity Policy with Spring Security @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.headers() .contentSecurityPolicy("script-src 'self' " + "https: / / trustedscripts.example.com; " + "object-src https: / / trustedplugins.example.com; " + "report-uri /csp-report-endpoint/"); } }
- 34. Test Your SecurityHeaders https://securityheaders.com
- 35. @mraible 6. Use OAuth2.0 and OpenID Connect OpenID Connect OAuth 2.0 HTTP OpenID Connect is for authentication OAuth 2.0 is for authorization
- 36. @mraible Authorization Code FlowExample https://developer.okta.com/blog/2019/08/28/reactive-microservices-spring-cloud-gateway
- 37. @mraible Does OAuth 2.0feel like a maze of specs? https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
- 38. @mraible OAuth 2.1 tothe rescue! https://oauth.net/2.1 PKCE is required for all clients using the authorization code flow Redirect URIs must be compared using exact string matching The Implicit grant is omitted from this specification The Resource Owner Password Credentials grant is omitted from this specification Bearer token usage omits the use of bearer tokens in the query string of URIs Refresh tokens for public clients must either be sender-constrained or one-time use
- 39. 7. Prevent CSRFAttacks
- 40. Configure CSRF Protectionwith Spring Security @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf() .csrfTokenRepository( CookieCsrfTokenRepository.withHttpOnlyFalse()); } }
- 41.
- 42.
- 43. 1. Use HTTPS 2.Scan your dependencies 3. Use the latest releases 4. Secure your secrets Recap: 7 Simple Ways to Better Web App Security 5. Use a Content Security Policy 6. Use OAuth 2.0 and OIDC 7. Prevent Cross-site request forgery (CSRF)
- 44.
- 45. Curious About MicroserviceSecurity? https://developer.okta.com/blog/2020/03/23/microservice-security-patterns
- 46. Or Auth SecurityPatterns? https://bit.ly/mraible-springone-2021 https://youtu.be/CebTJ7Nq1Hs
- 47.
- 48.