This course shows experienced developers of Java web applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.
Before taking this course, Java programming experience is essential. Servlets programming experience is required. JSP page-authoring experience is recommended but not required.
4 Days/Lecture & Lab
This course is designed for experienced Java developers.
- Concerns for Web Applications
- Authentication and Authorization
- Common Web Attacks
- Input Validation
- HTTPS and Certificates
- Application-Level Cryptography
- Secure Development Practices
- Appendix A. Learning Resources