Build Secure Java Web Applications

Introduction to secure coding: the core principles of writing secure Java code.

Secure SDLC: integrating security into design, code review, build pipelines and testing across the development lifecycle.

Black-box testing vs code review: comparing external assessment with source-level review of Java/Spring code.

Secure coding principles: defensive defaults and safe framework APIs for avoiding common vulnerability classes.

Burp Suite introduction: intercepting and analyzing the traffic of a Spring web application to understand its behavior.

Bug Bounties: how the programs work and how a company can adopt them, alongside penetration testing, to keep surfacing new vulnerabilities as part of a secure development process.

Information Gathering: enumerating an application's entry points and attack surface from the attacker's perspective.

Application Fingerprinting: identifying framework, library and configuration details that inform an attack.

Improper Error Handling: preventing information disclosure through stack traces and verbose error responses in Spring.

Injection: SQL injection and related flaws, and defending against them with JPA/Hibernate parameter binding and prepared statements.

Authentication: common authentication vulnerabilities and secure implementation with Spring Security.

JWT: understanding JSON Web Tokens and using them safely for stateless authentication.

Authorization: access-control flaws and secure method- and URL-level authorization with Spring Security.

Application Logic: preventing attacks that abuse multi-step workflows and business rules.

Sensitive Data Exposure in transit: enforcing TLS and protecting data on the wire.

Sensitive Data Exposure at rest: protecting stored data with sound cryptography and key management.

Data Validation: input validation and sanitization with Bean Validation (JSR-380) and safe binding.

Open Redirect: identifying and preventing unvalidated redirect and forward vulnerabilities.

Arbitrary File Upload: securely handling uploaded files to prevent code execution and path traversal.

Vulnerable and outdated components: managing third-party and transitive dependency risk with Maven/Gradle.

XXE: understanding and preventing XML External Entity attacks through safe parser configuration.

Session Management: secure session handling and fixation defenses in Spring applications.

SSRF: understanding and mitigating Server-Side Request Forgery.

CORS security: understanding Cross-Origin Resource Sharing and configuring it safely in Spring.

CSP: using Content Security Policy to reduce the impact of client-side injection.

Clickjacking: framing attacks and how to prevent them with the right response headers.

Denial of Service: application-level denial-of-service conditions and mitigation techniques.

Software and Data Integrity failures: preventing insecure deserialization (safe Jackson configuration) and integrity issues.

Spring Boot and Spring Security: combining the framework's security features into a coherent baseline.

Spring Security vs .NET Security: a comparative look at how the two ecosystems solve the same problems.