HARTMANN software group

Spring Framework Security Training in Santa Ana

Enroll in or hire us to teach our Spring Framework Security class in Santa Ana, California by calling us @303.377.6176. Like all HSG classes, Spring Framework Security may be offered either onsite or via instructor led virtual training. Consider looking at our public training schedule to see if it is scheduled: Public Training Classes
Provided there are enough attendees, Spring Framework Security may be taught at one of our local training facilities.
We offer private customized training for groups of 3 or more attendees.
get pricing information

Course Description

  
This in-depth course introduces the Java web developer to the Spring Security framework. We start with an overview and practical exercises in basic usage: XML configuration for authentication and URL-based authorization. Then we start to dig into Spring Security as a Java model, and develop advanced techniques including custom user realms, custom authorization constraints, method-based authorization, and instance-based authorization. We then explore two increasingly popular extensions to Spring Security. We consider the Security Assertions Markup Language, or SAML, and the wide range of identity and security features it offers -- but quickly focus on it's support for single sign-on (SSO), and learn how the Spring Security SAML Extension enables applications to interact with SAML identity providers to implement SSO and single logout. And we look at OAuth for Spring Security, which enables third-party authorization scenarios, and learn how to implement both the server and client sides of the OAuth 2.0 flow.
Course Length: 3 Days
Course Tuition: $1090 (US)

Prerequisites
Java, in particular Servlet, programming experience is essential.

Course Outline

  

Chapter 1. Secure Web Applications

  • Threats and Attack Vectors
  • Server, Network, and Browser Vulnerabilities
  • Secure Design Principles
  • GET vs. POST
  • Container Authentication and Authorization
  • HTML Forms
  • Privacy Under /WEB-INF
  • HTTP and HTTPS
  • Other Cryptographic Practices
  • SOA and Web Services
  • The OWASP Top 10

Chapter 2. Authentication and Authorization

  • HTTP BASIC and DIGEST Authentication Schemes
  • Declaring Security Constraints
  • User Accounts
  • Safeguarding Credentials in Transit
  • Replay Attacks
  • Authorization Over URL Patterns
  • Roles
  • FORM Authentication
  • Login Form Design
  • EJB Authorization
  • Programmatic Security
  • Programmatic Security in JSF

Chapter 3. Secure Application Design

  • Single Points of Decision
  • Cross-Site Scripting
  • Validation vs. Output Escaping
  • Forceful Browsing
  • Cross-Site Request Forgery
  • Request Tokens
  • Injection Attacks
  • Protections in JDBC and JPA
  • Session Management
  • Taking Care of Cookies
  • Validating User Input
  • Validation Practices
  • Regular Expressions
  • JSF Validation

Chapter 4. HTTPS and Certificates

  • Digital Cryptography
  • Encryption
  • SSL and Secure Key Exchange
  • Hashing
  • Signature
  • Keystores
  • keytool
  • Why Keys Aren't Enough
  • X.509 Certificates
  • Certificate Authorities
  • Obtaining a Signed Certificate
  • Configuring HTTPS
  • Client-Side Certificates and Two-Way SSL
  • PKCS #12 and Trust Stores
  • CLIENT-CERT Authentication

Chapter 5. Application-Level Cryptography

  • The Java Cryptography Architecture
  • Secure Random Number Generation
  • The KeyStore API
  • The Signature Class
  • The SignedObject Class
  • The MessageDigest Class
  • The Java Cryptography Extensions
  • The SecretKey and KeyGenerator Types
  • The Cipher Class
  • Choosing Algorithms and Key Sizes
  • Dangerous Practices

Chapter 6. Secure Development Practices

  • Secure Development Cycle
  • Error Handling and Information Leakage
  • Failing to a Secure Mode
  • Logging Practices
  • Appropriate Content for Logs
  • Auditing
  • Strategies: Filters, Interceptors, and Command Chains
  • Penetration Testing
  • Back Doors

Appendix A. Learning Resources

Course Directory [training on all levels]

Technical Training Courses
Software engineer/architect, System Admin ... Welcome!
Business Training Courses
Project Managers, Business Analysts, Paralegals ... Welcome!
Upcoming Classes
Gain insight and ideas from students with different perspectives and experiences.

Java Programming Uses & Stats

Java Programming is Used For:
Android & IOS Development Software Products Video Games Desktop GUI's
Difficulty
Popularity
Year Created
1995
Pros

Most Commonly Used: 
According to Oracle, three billion devices run on Java.  And, because of its real-world applications, it consistently ranks at the top of the TIOBE Programming Community Index. 

Great Career Choice: 
Some of the fastest-growing salaries in the U.S. in 2018 are for Java developers.  (Glassdoor)  

Android Apps Development:
Developers predominatly use their Java skills in building apps for Google's Android. The Android platform is the number one mobile paltform in the world

It Can Run On Any Platform:
Java can compile on Windows and run the same compiled file on Linux, Windows and Mac.

Great Supporting IDE's:
Over the years, coding in Java has become simpler with the introduction of open source development tools, i.e. Eclipse and NetBeans that use Java capabilities for debugging.  
 
Cons

Uses a Lot of Memory:
Performance can be significantly slower with Java and more memory-consuming than natively compiled languages such as C or C++.

Difficulty in Learning: 
Learning Java can be a bit challenging if you are a beginner.  However, once you get the hang of Object Oriented Programming and a decent grasp of the syntax, you will be well on your way.

Slow Start Up Times:
There is quite a bit of one-time initialization done by JDK classes before compiling as well as loading classes and verification (making sure code doesn't do evil things, all of which takes longer that some other languages such as C. 

Verbose and Complex Code:
Long, over-complicated sentences make code less readable and scannable. Compare to let's say Python, we can see how clear Python code appears: It doesn’t require semicolons; uses “and,” “or,” and “not” as operators instead of Java’s “&&,” “||,” and “!”; and generally has fewer bells and whistles such as parentheses or curly braces.

Commercial License Cost:
Companies have to prepare for the changes that Oracle will institute in 2019 . Today, the current version of Java is free and available for redistribution for general purpose computing. However, If you are a DEVELOPER, Oracle recommends you review the roadmap information for Java SE 8 and beyond and take appropriate action depending on the type of application you develop and your distribution mode.
Java Programming Job Market
Average Salary
$102,000
Job Count
26,856
Top Job Locations

New York City 
San Jose
Washington D.C, 
Complimentary Skills to have along with Java Programming

- If you are an experienced Java developer, learning a complimentary language to Java should come much more naturally.  As an example JetBrains recently created the Kotlin programming language which is officially supported by Google for mobile development.  Kotlin compiles to Java bytecode and runs on the JVM; it's purported to address many of Java's shortcomings...

Interesting Reads Take a class with us and receive a book of your choosing for 50% off MSRP.