Secure Java Web Development Training in Gatesville, Texas

Chapter 1. Concerns for Web Applications

• Threats and Attack Vectors
• Server, Network, and Browser Vulnerabilities
• Secure Design Principles
• GET vs. POST
• Container Authentication and Authorization
• HTML Forms
• Privacy Under /WEB-INF
• HTTP and HTTPS
• Other Cryptographic Practices
• SOA and Web Services
• The OWASP Top 10

Chapter 2. Authentication and Authorization

• HTTP BASIC and DIGEST Authentication Schemes
• Declaring Security Constraints
• User Accounts
• Safeguarding Credentials in Transit
• Replay Attacks
• Authorization Over URL Patterns
• Roles
• FORM Authentication
• Login Form Design
• Session Fixation
• Protections
• Programmatic Security
• Programmatic Security in JSF

Chapter 3. Common Web Attacks

• Forceful Browsing
• Predictable Resource Locations
• Using Random Numbers
• Cross-Site Scripting
• Output Escaping
• Cross-Site Request Forgery
• Synchronizer Tokens
• Injection Attacks
• Protections in JDBC and JPA
• Session Management
• Taking Care of Cookies

Chapter 4. Input Validation

• Validating User Input
• Validation Practices
• Regular Expressions
• Bean Validation (a/k/a JSR-303)
• Constraint Annotations
• Cross-Field Validation
• Built-In Support in Java EE
• Using a Validator
• Producing Error Responses
• JSF Validation

Chapter 5. HTTPS and Certificates

• Digital Cryptography
• Encryption
• SSL and Secure Key Exchange
• Hashing
• Signature
• Keystores
• keytool
• Why Keys Aren't Enough
• X.509 Certificates
• Certificate Authorities
• Obtaining a Signed Certificate
• Configuring HTTPS
• Client-Side Certificates and Two-Way SSL
• PKCS #12 and Trust Stores
• CLIENT-CERT Authentication

Chapter 6. Application-Level Cryptography

• The Java Cryptography Architecture
• Secure Random Number Generation
• The KeyStore API
• Digital Signature
• Hashing
• Password Hashing
• Why Hashing Isn't Enough
• Salts
• Key Lengthening and Key Strengthening
• Slow Algorithms
• The Java Cryptography Extensions
• The SecretKey and KeyGenerator Types
• Symmetric Encryption
• Choosing Algorithms and Key Sizes
• Dangerous Practices
• Storing and Managing Keys

Chapter 7. REST Security Basics

• Security Concerns for REST Services
• HTTPS
• HTTP BASIC and DIGEST
• Authorization by URL Pattern
• Cross-Site Scripting
• Injection Attacks
• Cross-Site Request Forgery
• Common Countermeasures

Chapter 8. HMAC Security

• Use Case: Message Authentication
• Digital Signature
• Hashing as Signature: the HMAC
• Keyed Hashing
• The Hmac Utility
• Appropriate Salts
• Canonicalization
• Amazon S3
• Timestamps
• Signing and Verifying Messages
• XML Cryptography and Canonicalization
• Canonicalizing JSON

Chapter 9. SAML SSO

• The Challenge of Single Sign-On
• Federated Identity
• SAML 2.0
• The Web Browser SSO Profile
• Identity Providers and Service Providers
• SAML Assertions
• SAML Protocol
• SAML Bindings
• Speaking "Through" the Browser
• The HTTP Redirect Binding
• Artifact and SOAP Bindings
• SAML Attributes
• Security Concerns in SSO Systems

Chapter 10. OAuth

• Use Case: Third-Party Authorization
• OAuth
• Initial Flow
• Grant Types
• Access Tokens
• The Google OAuth API
• Implementing Authorization and Resource Servers
• Implementing Clients
• Security Concerns with OAuth

Appendix A. Learning Resources