Working with Security
1. Understanding Java Security Architecture
| Component | Role |
|---|
| Class verifier | Bytecode safety |
| JCA / JCE | Cryptography APIs |
| JAAS | Authentication / authorization |
| Security Manager | Deprecated for removal (Java 17+) |
2. Using SecurityManager
| Aspect | Detail |
|---|
| Status | Deprecated for removal in Java 17+ (JEP 411) |
| Alternatives | OS-level sandboxing, containers, modules |
3. Working with Cryptography (JCA)
Example: Symmetric encryption
KeyGenerator kg = KeyGenerator.getInstance("AES");
kg.init(256);
SecretKey key = kg.generateKey();
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
byte[] iv = new byte[12];
SecureRandom.getInstanceStrong().nextBytes(iv);
cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
byte[] cipherText = cipher.doFinal(plainBytes);
| Class | Use |
|---|
Cipher | Encryption/decryption |
KeyGenerator / KeyPairGenerator | Key creation |
MessageDigest | Hash (SHA-256) |
Mac | HMAC |
SecureRandom | CSPRNG |
4. Hashing Passwords
| Algorithm | Use |
|---|
| PBKDF2 | Built-in (SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256")) |
| bcrypt | Industry standard (libraries) |
| Argon2 | Modern winner of PHC |
Warning: Never store passwords with raw SHA/MD5. Always use a slow KDF (PBKDF2/bcrypt/Argon2) with a per-user salt.
5. Using SSL/TLS
| Class | Use |
|---|
SSLContext | Configuration |
SSLSocketFactory / SSLServerSocketFactory | TLS sockets |
HttpClient | Uses default SSLContext |
| Versions | TLS 1.3 default in modern JDKs |
6. Working with Certificates
| Tool/Class | Use |
|---|
keytool | Manage keystores |
KeyStore | Programmatic access (JKS, PKCS12) |
X509Certificate | Cert representation |
| Default truststore | $JAVA_HOME/lib/security/cacerts |
7. Implementing Authentication
| Mechanism | Detail |
|---|
| JAAS | Standard but legacy feel |
| Spring Security / Shiro | De facto frameworks |
| OAuth/OIDC | For web apps |
8. Implementing Authorization
| Pattern | Detail |
|---|
| RBAC | Role-based |
| ABAC | Attribute-based |
| Java implementation | Filter requests at framework layer |
9. Preventing SQL Injection
| Practice | Detail |
|---|
| PreparedStatement | Always use parameter binding |
| Never concat input | Even with sanitization |
| ORM | JPA/Hibernate use parameters by default |
10. Preventing XML/JSON Injection
| Risk | Mitigation |
|---|
| XXE | Disable DTDs/external entities on parsers |
| JSON deserialization | Whitelist types; avoid polymorphic typing |
| XML signature wrapping | Strict schema validation |
11. Securing Deserialization
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
"com.example.model.*;java.util.*;java.lang.*;!*"
);
ObjectInputStream ois = new ObjectInputStream(in);
ois.setObjectInputFilter(filter);
| Practice | Detail |
|---|
| Whitelist classes | ObjectInputFilter |
| Avoid Java serialization | Prefer JSON/Protobuf |
| Update libs | CVEs in serialization libs are common |
| Practice | Detail |
|---|
| Whitelist over blacklist | Define what's valid |
| Bean Validation (JSR 380) | @NotNull, @Size, @Pattern, @Email |
| Canonicalize first | Then validate (paths, URLs) |
13. Using Secure Random
| Form | Detail |
|---|
SecureRandom.getInstanceStrong() | Most secure available |
new SecureRandom() | Default CSPRNG |
| Avoid | java.util.Random for security |