Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web App Security Made Simple - Vaadin Webinar 2020

Web App Security Made Simple - Vaadin Webinar 2020

Web app security is not just authentication and authorization. It's also the things you do to protect your web app from attackers with their XSS (cross-site scripting), SQL injection, DoS/DDoS attacks, and CSRF (cross-site request forgery), to name a few.

Web app security is a central component of any web-based business. The internet exposes web apps to attacks from different locations and various levels of scale and complexity. Web application security deals specifically with the security surrounding websites, web applications, and web services such as APIs.

In this presentation, you'll learn seven ways to better web app security, using Spring Security for code samples. You'll also see some quick demos of Spring Boot, Angular, and JHipster with Okta.

YouTube video: https://youtu.be/ZIweXk3guaE

Matt Raible

November 17, 2020
Tweet

More Decks by Matt Raible

Other Decks in Programming

Transcript

  1. Matt Raible | @mraible November 17, 2020 Web App Security

    made Simple Photo by Billy Williams on https://unsplash.com/photos/8wz1Q4Q_XAg
  2. @mraible Who is Matt Raible? Father, Husband, Skier, Mountain Biker,

    Whitewater Rafter Bus Lover Web Developer and Java Champion Okta Developer Advocate Blogger on raibledesigns.com and developer.okta.com/blog @mraible
  3. @mraible Today’s Agenda What is web app security? 7 simple

    ways to better app security 3 quick demos Spring Boot Angular JHipster
  4. 1. Use HTTPS 2. Scan your dependencies 3. Use the

    latest releases 4. Secure your secrets 7 Simple Ways to Better Web App Security 5. Use a Content Security Policy 6. Use OAuth 2.0 and OIDC 7. Prevent Cross-site request forgery (CSRF)
  5. @mraible 1. Use HTTPS Everywhere! Let’s Encrypt offers free HTTPS

    certificates certbot can be used to generate certificates mkcert can be used to create localhost certificates Spring Boot Starter ACME for automating certificates
  6. Force HTTPS in Spring Boot @Configuration public class SecurityConfiguration extends

    WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel().anyRequest().requiresSecure(); } }
  7. Force HTTPS in the Cloud @Configuration public class SecurityConfiguration extends

    WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel() .requestMatchers(r "-> r.getHeader("X-Forwarded-Proto") "!= null) .requiresSecure(); } }
  8. How well do you know your dependencies? Dependency Health Indirect

    Dependencies Regular Releases Regular commits Dependencies
  9. Check for Updates with Gradle plugins { id("se.patrikerdes.use-latest-versions") version "0.2.13"

    id("com.github.ben-manes.versions") version "0.28.0" ""... } $ ./gradlew useLatestVersions https://github.com/patrikerdes/gradle-use-latest-versions-plugin
  10. Default Spring Security Headers Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma:

    no-cache Expires: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY X-XSS-Protection: 1; mode=block
  11. Add a Content Security Policy with Spring Security @EnableWebSecurity public

    class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.headers() .contentSecurityPolicy("script-src 'self' " + "https:"//trustedscripts.example.com; " + "object-src https:"//trustedplugins.example.com; " + "report-uri /csp-report-endpoint/"); } }
  12. @mraible 6. Use OAuth 2.0 and OpenID Connect OpenID Connect

    OAuth 2.0 HTTP OpenID Connect is for authentication OAuth 2.0 is for authorization
  13. @mraible Does OAuth 2.0 feel like a maze of specs?

    https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
  14. @mraible OAuth 2.1 to the rescue! https://oauth.net/2.1 PKCE is required

    for all clients using the authorization code flow Redirect URIs must be compared using exact string matching The Implicit grant is omitted from this specification The Resource Owner Password Credentials grant is omitted from this specification Bearer token usage omits the use of bearer tokens in the query string of URIs Refresh tokens for public clients must either be sender-constrained or one-time use
  15. Configure CSRF Protection with Spring Security @EnableWebSecurity public class SecurityConfiguration

    extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf() .csrfTokenRepository( CookieCsrfTokenRepository.withHttpOnlyFalse()); } }
  16. 1. Use HTTPS 2. Scan your dependencies 3. Use the

    latest releases 4. Secure your secrets Recap: 7 Simple Ways to Better Web App Security 5. Use a Content Security Policy 6. Use OAuth 2.0 and OIDC 7. Prevent Cross-site request forgery (CSRF)