Use PreparedStatement and parameterized queries to prevent injection; 2. Implement Spring Security with strong password hashing and MFA for secure authentication; 3. Enforce RBAC with @PreAuthorize and deny-by-default access control; 4. Encrypt data in transit with TLS 1.2 and at rest using AES-256 with secure key management; 5. Harden configurations by disabling debug modes, setting secure headers like CSP and HSTS, and centralizing secrets; 6. Prevent XSS by escaping output with OWASP Java Encoder and using auto-escaping templates like Thymeleaf; 7. Mitigate SSRF by validating and whitelisting URLs, blocking internal IPs, and isolating backend networks; 8. Secure dependencies via regular scanning with OWASP Dependency-Check or Snyk and automated updates; 9. Handle errors safely by logging exceptions without exposing stack traces and avoiding PII in logs; 10. Protect APIs with input validation using @Valid, rate limiting, DTOs for minimal data exposure, and JWT-based authentication; additionally, use Spring Boot’s secure defaults, perform regular security testing with tools like SonarQube and OWASP ZAP, follow least privilege, and keep all software updated to defend against OWASP Top 10 risks in Java web applications.

Securing a Java web application against the OWASP Top 10 vulnerabilities requires a combination of secure coding practices, proper configuration, and the use of modern frameworks and tools. Below are practical, actionable steps to defend against each of the current OWASP Top 10 (2021) risks in a Java-based environment.

1. Prevent Injection (e.g., SQL, Command, LDAP)

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.

How to Secure:

• Use Prepared Statements or Parameterized Queries
  Never concatenate user input into SQL queries. Use PreparedStatement:

  String sql = "SELECT * FROM users WHERE username = ?";
  PreparedStatement pstmt = connection.prepareStatement(sql);
  pstmt.setString(1, username);

• Use ORM Frameworks Safely
  Hibernate or JPA are safe if you avoid HQL queries with string concatenation. Use named parameters:

  

  Query<User> query = session.createQuery("FROM User u WHERE u.email = :email", User.class);
  query.setParameter("email", userEmail);

• Validate and Sanitize Input
  Use libraries like Hibernate Validator (@Pattern, @Email) to enforce input format.

2. Authenticate Securely and Manage Identities

Broken authentication can allow attackers to compromise passwords, keys, or tokens.

How to Secure:

• Use Established Authentication Libraries
  Avoid rolling your own auth. Use Spring Security or OAuth2/OpenID Connect via libraries like Spring Security OAuth or Keycloak.

• Enforce Strong Password Policies
  Require minimum length, complexity, and use bcrypt, scrypt, or PBKDF2 for hashing:

  BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  String hashed = encoder.encode(rawPassword);

• Implement Multi-Factor Authentication (MFA)
  Add an extra layer using TOTP or SMS/email verification.

• Secure Session Management
  Use secure, HTTP-only cookies and regenerate session IDs after login.

3. Protect Against Broken Access Control

Access control enforces that users can only access what they’re authorized to.

How to Secure:

• Enforce Role-Based Access Control (RBAC)
  Use Spring Security annotations:

  @PreAuthorize("hasRole('ADMIN')")
  public void deleteUser(Long id) { ... }

• Never Rely on Hiding URLs
  Always check permissions server-side, even if UI hides options.

• Deny by Default
  Explicitly define allowed actions; assume all others are forbidden.

4. Encrypt Sensitive Data (Cryptographic Failures)

Storing or transmitting sensitive data without proper encryption leads to exposure.

How to Secure:

• Always Use HTTPS
  Enforce TLS 1.2 in production. Use tools like Let’s Encrypt for certificates.

• Encrypt Sensitive Data at Rest
  Use strong algorithms (AES-256) and manage keys securely (e.g., with AWS KMS or HashiCorp Vault).

• Avoid Weak Algorithms
  Don’t use MD5, SHA-1, or DES. Use SHA-256 and AES.

• Don’t Store What You Don’t Need
  Minimize collection and retention of sensitive data (e.g., passwords, SSNs).

5. Secure Configuration (Security Misconfiguration)

Default settings, verbose errors, or unused features expose systems.

How to Secure:

• Harden Your Environment
  Disable debug modes, remove sample apps, and keep dependencies updated.

• Use Secure Headers
  Set HTTP security headers via filters or frameworks:

  • Content-Security-Policy
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Strict-Transport-Security

  In Spring, use:

  http.headers().frameOptions().deny().and().contentTypeOptions().and().hsts();

• Centralize Configuration
  Use application.properties or application.yml with profile-specific settings. Never store secrets in code.

6. Validate and Sanitize User Input (XSS Prevention)

Cross-Site Scripting (XSS) occurs when apps include untrusted data in responses.

How to Secure:

• Escape Output
  Use context-aware escaping:

  • For HTML: Use OWASP Java Encoder:

    <%= Encode.forHtml(userContent) %>

  • For JavaScript: Use Encode.forJavaScript()

• Use Modern Frameworks
  Thymeleaf, JSF, or Spring automatically escape output by default—ensure you’re not disabling it.

• Apply Content Security Policy (CSP)
  Restrict sources for scripts, styles, and other resources.

7. Protect Against SSRF (Server-Side Request Forgery)

SSRF lets attackers induce the server to make unintended requests.

How to Secure:

• Validate and Whitelist URLs
  If your app fetches remote resources (e.g., webhooks, avatars), validate the target:

  • Block localhost, internal IPs (10.x, 192.168.x, etc.)
  • Use a allowlist of permitted domains

• Use Network Segmentation
  Run backend services in isolated networks with no external access.

• Avoid Exposing URL Fetching to Users
  If possible, avoid letting users input URLs that your server will fetch.

8. Use Dependencies Safely (Software and Data Integrity Failures)

Using vulnerable or tampered components can introduce backdoors.

How to Secure:

• Scan Dependencies Regularly
  Use tools like:

  • OWASP Dependency-Check
  • Snyk
  • Maven/Gradle plugins to detect known vulnerabilities

• Keep Libraries Updated
  Subscribe to security mailing lists or use automated tools (e.g., Dependabot).

• Verify Integrity
  Use signed artifacts and checksums when possible.

9. Implement Proper Error Handling and Logging

Poor logging or verbose errors can leak system details.

How to Secure:

• Don’t Expose Stack Traces
  Return generic error messages to users:

  try {
      // ...
  } catch (Exception e) {
      log.error("Operation failed for user: {}", userId, e);
      throw new CustomException("An error occurred.");
  }

• Log Enough for Forensics, Not Too Much
  Avoid logging passwords, tokens, or PII.

• Monitor Logs for Suspicious Activity
  Use tools like ELK Stack or Splunk to detect brute force, injection attempts, etc.

10. Secure APIs (API Security)

Modern apps rely on APIs, which are prone to broken object-level authorization, excessive data exposure, etc.

How to Secure:

• Validate All Input in API Endpoints
  Use @Valid and Bean Validation in Spring Boot:

  public ResponseEntity<User> createUser(@Valid @RequestBody User user) { ... }

• Use Rate Limiting
  Prevent abuse with tools like Spring Cloud Gateway or custom filters.

• Avoid Excessive Data Exposure
  Don’t return full objects if only a few fields are needed. Use DTOs.

• Authenticate and Authorize Every Request
  Use JWT with proper signature validation and short-lived tokens.

Bonus: General Best Practices

• Use Spring Boot with Security Auto-configuration
  It enables many protections by default (CSRF, secure headers, etc.).

• Perform Regular Security Testing

  • Static Analysis: SonarQube, SpotBugs with security plugins
  • Dynamic Scanning: OWASP ZAP, Burp Suite
  • Penetration Testing: Schedule regular tests

• Follow the Principle of Least Privilege
  Run your app with minimal OS and DB permissions.

• Keep Java and Frameworks Updated
  Patch known vulnerabilities in JVM, Tomcat, Spring, etc.

Basically, securing a Java web app isn’t about one magic fix—it’s consistent application of defense layers: input validation, output encoding, secure defaults, and proactive monitoring. Use mature frameworks, automate security checks, and stay updated.

The above is the detailed content of How to Secure a Java Web Application from OWASP Top 10 Vulnerabilities. For more information, please follow other related articles on the PHP Chinese website!