Working with Security Features

1. Using Java Security Manager

Warning: SecurityManager is deprecated for removal since Java 17 (JEP 411). Do not adopt for new code. Use OS-level isolation (containers), JPMS encapsulation, and input validation instead.
StatusJava Version
Active default1.0–17
Deprecated for removal17 (JEP 411)
Disabled defaultJava 18+ (-Djava.security.manager=disallow)
RemovedTargeted Java 25+

2. Configuring Security Policies

FileUse
$JAVA_HOME/conf/security/java.policyDefault grants
Per-app policy-Djava.security.policy=app.policy
Formatgrant codeBase "...". { permission ...; }
StatusTied to deprecated SecurityManager

3. Using Security Manager Alternatives (Java 17+)

AlternativeUse
JPMS encapsulationLimit reflective access
Container isolationLinux namespaces, seccomp, AppArmor
Process isolationMulti-process design
Input validationOWASP-style at boundaries
Serialization filtersObjectInputFilter

4. Working with Cryptography (JCE)

ClassUse
MessageDigestHash (SHA-256, SHA3)
MacHMAC
CipherSymmetric/asymmetric encrypt
SignatureSign/verify
KeyAgreementDH/ECDH

5. Using MessageDigest

Example: SHA-256

byte[] hash = MessageDigest.getInstance("SHA-256")
    .digest("hello".getBytes(StandardCharsets.UTF_8));
String hex = HexFormat.of().formatHex(hash);
AlgorithmUse
SHA-256 / SHA-384 / SHA-512General-purpose
SHA3-256 etc.NIST SHA-3
MD5 / SHA-1DEPRECATED non-security only

6. Using Cipher

Example: AES-GCM

byte[] iv = new byte[12]; new SecureRandom().nextBytes(iv);
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
byte[] ct = c.doFinal(plain);
ModeUse
AES/GCM/NoPaddingAuthenticated encryption (preferred)
ChaCha20-Poly1305Modern AEAD alt
RSA/ECB/OAEPWith...Asymmetric encryption
AES/CBC/PKCS5PaddingLegacy; use only with HMAC

7. Working with KeyStore

TypeUse
PKCS12Default since Java 9
JKSLegacy proprietary
Operationsload/store, getKey, getCertificate
Toolkeytool

8. Using SecureRandom

APIUse
SecureRandom.getInstanceStrong()Strong (may block on Linux NativePRNGBlocking)
new SecureRandom()Default (DRBG on modern JDK)
DRBGNIST SP 800-90A; configure via SecureRandomParameters
NEVERUse Random or Math.random() for crypto

9. Implementing SSL/TLS Connections

APIUse
SSLContext.getInstance("TLSv1.3")TLS 1.3 (Java 11+)
init(km, tm, sr)Key/trust managers
SSLSocketFactory / SSLEngineBlocking / non-blocking
HttpClient.sslContext(ctx).sslParameters(p)
Hostname verificationEnabled by default in HttpClient

10. Using JAAS (authentication, authorization)

ComponentUse
LoginContextAuthenticate
LoginModulePluggable mechanism (Krb5, LDAP)
Subject + PrincipalIdentity carrier
Subject.doAsRun-as (tied to SecurityManager — declining)

11. Understanding Security Providers

AspectDetail
Provider classRegisters algorithms
Built-insSunJCE, SunEC, SunPKCS11, SunMSCAPI
Bouncy CastlePopular 3rd-party
SelectionSecurity.getProviders() or by name in getInstance()

12. Preventing Common Vulnerabilities

VulnerabilityPrevention
SQL injectionPreparedStatement with parameters
XXEDisable DTDs in XML parsers
Deserialization RCEObjectInputFilter / avoid Java serialization
JNDI injection (Log4Shell)Validate/escape user input; patch logging libs
Path traversalValidate normalized paths against base
Command injectionProcessBuilder with arg list (not concatenated string)
Insecure TLSUse TLS 1.2/1.3, validate hostnames
Weak cryptoAES-GCM ≥ 128, RSA ≥ 2048, ECDSA P-256+

Related Cheat Sheets

Spring Boot

Working with External APIs

Authentication Authorization

Working with Biometric Authentication

Distributed Systems

Implementing Data Partitioning

GRAPHQL

Working with GraphQL over HTTP