Use PreparedStatement to prevent SQL injection, avoid executing user input expressions, and whitelist verification of inputs; 2. Use mature frameworks such as Spring Security to manage authentication, use strong hash storage such as bcrypt, set the cookies of HttpOnly and Secure and regenerate the session ID; 3. Use OWASP Java Encoder to encode HTML and JavaScript contexts when output, set CSP header to limit the source of scripts, prohibit inline scripts and eval(); 4. Verify input uniformly on the server, use JSR-380 to annotate the verification parameters, limit file upload type and size, and verify file paths to prevent path traversal; 5. Use OWASP to use OWASP to uniformly verify input, use JSR-380 to annotate verification parameters, limit file upload type and size, and verify file paths to prevent path traversal; 5. Use OWASP to verify input uniformly, use JSR-380 to annotate verification parameters, limit file upload type and size, and verify file paths to prevent path traversal; 5. Use OWASP Dependency-Check regularly scans for dependency vulnerabilities, closes debugging information in the production environment, and configures security response headers such as X-Content-Type-Options, X-Frame-Options, HSTS, etc.; 6. Use @PreAuthorize to achieve RBAC permission control, and the backend checks permissions every time it requests to avoid directly exposing the database ID. It is recommended to use UUID. Security needs to run through the entire development process. Following the above specifications can effectively prevent common vulnerabilities and ensure the security of Java Web applications.

Writing secure Java Web applications is key to preventing data breaches, service outages, and malicious attacks. As web applications become increasingly complex, developers must follow a range of security coding specifications to reduce security risks. The following is a practical security coding guide for Java Web applications covering common vulnerabilities and best practices.

1. Prevent injection attacks (SQL, command, expression injection)

Injection is the top vulnerability type in OWASP Top 10 in the medium and long term. The attacker manipulates the backend logic by constructing malicious input.

Key measures:

• Use precompiled statements (PreparedStatement)
  Avoid splicing of SQL strings, always use PreparedStatement and parameter placeholders:

   String sql = "SELECT * FROM users WHERE username = ?";
  try (PreparedStatement pstmt = connection.prepareStatement(sql)) {
      pstmt.setString(1, username);
      ResultSet rs = pstmt.executeQuery();
  }

• Avoid dynamic execution of EL expressions or OGNL
  Do not use javax.el.ELProcessor or similar mechanism to execute expressions entered by users.

  

• Input verification and whitelist filtering
  Verify all user inputs, using whitelists to limit allowed characters or formats.

2. Correctly handle identity authentication and session management

Identity authentication is the first line of defense for access control, and improper implementation may lead to account hijacking.

Suggested practices:

• Using a mature certification framework
  Priority is given to using mature frameworks such as Spring Security and Apache Shiro to avoid implementing login logic by yourself.

• Secure password storage
  Never store passwords explicitly. Use strong hashing algorithms (such as bcrypt, PBKDF2, Argon2):

   // PasswordEncoder using Spring Security
  @Autowired
  private PasswordEncoder passwordEncoder;
  
  String hashedPassword = passwordEncoder.encode(rawPassword);

• Security Management Session

  • Set the session timeout time (such as 30 minutes without operation)

  • Use secure cookie attributes:

     Cookie Cookie = new Cookie("JSESSIONID", sessionId);
    cookie.setHttpOnly(true); // Prevent XSS from reading cookie.setSecure(true); // Transfer cookie.setPath("/"); // Restrict paths

• Avoid fixed session ID
  Be sure to regenerate the session ID after logging in successfully to prevent session fixed attacks.

3. Defense Cross-Site Scripting (XSS)

XSS allows an attacker to execute malicious scripts in the user's browser, steal cookies, or impersonate users.

Protection strategy:

• Output encoding
  Perform appropriate encoding when outputting user data to HTML, JavaScript, URL contexts. Recommended to use OWASP Java Encoder:

   String safeOutput = Encode.forHtml(userInput);
  String safeScript = Encode.forJavaScript(userInput);

• Setting up content security policy (CSP)
  Restrict the source of executable scripts via HTTP response headers:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com

• Avoid inline scripts and eval()
  Try to use external JS files, and prohibit using eval() and innerHTML to splice user content.

4. Verify and protect input and output (input verification and output cleaning)

All data from the client should be considered untrusted.

Implementation points:

• Unified input verification layer
  All request parameters are checked at the controller or service layer, and bean Validation (JSR-380):

   public class UserForm {
      @NotBlank
      @Email
      private String email;
  
      @Size(min = 6, max = 20)
      private String password;
  }

• Limit file upload type and size

  • Check file extensions and MIME types (don't rely on frontend only)
  • Save the uploaded file outside the web root directory
  • Scan the file to contain malicious content

• Avoid path traversal
  Do not use user input directly as file path. Check whether the path is within the allowable range:

   Path baseDir = Paths.get("/safe/upload/dir").toAbsolutePath();
  Path userFile = Paths.get(inputFilename).toAbsolutePath();
  if (!userFile.startsWith(baseDir)) {
      throw new IllegalArgumentException("Invalid file path");
  }

5. Security configuration and dependency management

Many vulnerabilities are caused by misconfiguration or the use of vulnerable third-party libraries.

Notes:

• Regularly update the dependency library
  Use the Maven/Gradle plug-in to check for dependency vulnerabilities, such as:

   <!-- Maven OWASP Dependency-Check -->
  <plugin>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>8.5.0</version>
      <executions>
          <execution>
              <goals>
                  <goal>check</goal>
              </goals>
          </execution>
      </executions>
  </plugin>

• Close debug information and stack trace
  Disable detailed error pages in production environments to avoid leaking system information.

• Configure security response header
  Add the following HTTP security header:

   X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Strict-Transport-Security: max-age=31536000; includeSubDomains

6. Access control and permission verification

Even if the user is logged in, it must be checked whether he has permission to perform the action.

Best Practices:

• Implement role-based access control (RBAC)
  Use the @PreAuthorize annotation for Spring Security:

   @PreAuthorize("hasRole('ADMIN')")
  @DeleteMapping("/users/{id}")
  public ResponseEntity<?> deleteUser(@PathVariable Long id) { ... }

• Permission checks are performed every request
  Even if the front end hides the button, the backend still needs to verify whether the current user can access the resource (preventing unauthorized access).

• Avoid exposing database ID directly
  Consider using UUID or indirect references to reduce the risk of ID guessing.

Basically these core points. Security is not a one-time task, but a habit that runs through the entire process of development, testing and deployment. As long as you think about one more step when encoding, most common vulnerabilities can be avoided.

The above is the detailed content of Secure Coding Guidelines for Java Web Applications. For more information, please follow other related articles on the PHP Chinese website!