This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing. Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process. In the last part of the course we move beyond the scope of traditional, interactive web applications to consider RESTful web services, single sign-on systems, and third-party authorization. Students learn to perform HMAC cryptography as a means of HTTP message-level authentication, and get introductions and hands-on exercise with SAML SSO and OAuth.
Before taking this course, students should have the following skills and experience: • Java programming experience is essential – a Java programming course is excellent preparation. • Servlets programming experience is required – a Developing Java Web Applications course is recommended. • JSP page-authoring experience is recommended but not required -- again, a Developing Java Web Applications course is recommended. • Understanding of RESTful web services as implemented in JAX-RS will be highly beneficial, but is not strictly required. Consider a Developing RESTful Services Using Java course
5 days/Lecture & Lab
This course is designed for experienced developers of Java EE applications.