Security - Tips to develop a secured Java web application

I recently had to build a web application aiming to handle critical and confidential user data.

Security was the main challenge of this application.

Of course, security is a wide topic, so I 'll present here the security measures I had to take in the code to ensure data privacy and pass the security audit (black box and gray box)

OWASP

The bible of Web Security is the OWASP web site

The measures I had to take to counter the top 10 risk :

Web tiers

• Detect and reject some patterns on form submission ("<script" for example) (A3)
• Include a one time token inside every form, and challenge it server side on form submission (A8)
• Include a one time token inside every link that perform an write operation in database, and challenge it server side on action (A8)
• Configure and test the HTML escaping of variables of the framework rendering engine. (A3)
• Develop a full set of features to keep ids from being transfered client side. My strategy was to store ids in a "session context" and rely on it, transfering indexes instead - in the case of tables, for example (A4)
• Beware, sometimes the magic of your framework car introduce this vulnerability without even noticing!
• Restrict every entry point for the role allowed - based on a standard RBAC.
• Initiate redirects server side, redirecting to a static declared URL (no computation based on user input) (A10)
• Set the pragma:no-cache header

Database tiers

• 100% names queries. No concatenation. Never. (A1)
• Escaping of data rendered in PDF report. (A1)

App tiers

• Check the application server session cookie value algorithm (java.secure.Random) (A2)
• Set session timeout to an accurate duration (A2)
• Set the cookie-config to secure in web.xml - https only app (A2)
• Hide every HTTP response header that could give information to attacker

Other

• Configure iptables as "deny by default" with rules rejecting connection on unallowed port (A5)
• Enforce authorization between software components, according to the vendor specification(restrict by IP for example) (A5)
• Include operations in security configuration (A5) 
• Detect and protect sensitive data - including project owner in the process (A6)
• Stay updated on your technologies - mostly version updates and known vulnerabilities (A9)

Conclusion

This is obviously not exhaustive, common sense is important as well as training developers.

Anyway, we passed 3 security audit (code, web security, server vulnerability), not so bad !

Read More