How to avoid vulnerabilities and adopt security best practices?
summary
Analysis of open-source Java projects finds recurring, fixable security mistakes: numeric IDs that enable easy enumeration, endpoints that leak other users’ data without proper principal checks and throwing Forbidden (Broken Object Level Authorization), weak password handling that needs bcrypt and MFA, and Spring Security misconfigurations like permitAll or leaving dev profiles in production. Recommended protections include OWASP Top 10 checks, Content Security Policy headers, rate limiting (example: 10 calls/min per IP), dependency scanning with OWASP Dependency‑Check or Snyk, Web Application Firewalls, and mitigations for SSRF when servers fetch arbitrary URLs.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 3:20Java security importance
- 8:40OWASP Top 10 overview
- 11:29Broken object auth
- 15:46Broken auth in Java
- 20:05Broken property auth
- 23:59Unrestricted resource consumption
- 27:11Broken function auth
- 33:50Role vs attribute access control
- 36:47Unrestricted business flow access
- 37:50SSRF
- 43:08Spring Security misconfiguration
- 47:21CSP in practice
- 50:31Supply chain attacks
- 55:46Summary & Q&A
related talks
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
26mStop Hitting Yourself: How to Prevent Common Attacks to your Application
53mOWASP Top Ten Proactive Controls
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
59mPractical Security for Web Applications
49m10 Excellent Ways to Secure Your Spring Boot Application
46mThe Path of Secure Software