Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.

share|improve this question
Found the author's blog entry about the WAF release at, It has a link to a detailed pdf that will certainly help. – Tim Troy Nov 12 '10 at 22:52

You might try the wiki or javadocs.

share|improve this answer
The OWASP wiki has not been helpful to me. I never seem to find what I am looking for. The javadocs is what I would use once I was digging in deep. Just want to know how to get started with the tool. – Tim Troy Nov 12 '10 at 22:49

Start with org.owasp.esapi.waf.ESAPIWebApplicationFirewallFilter.
From the javadocs:

This is the main class for the ESAPI Web Application Firewall (WAF). It is a standard J2EE servlet filter that, in different methods, invokes the reading of the configuration file and handles the runtime processing and enforcing of the developer-specified rules. Ideally the filter should be configured to catch all requests (/*) in web.xml. If there are URL segments that need to be extremely fast and don't require any protection, the pattern may be modified with extreme caution.

share|improve this answer

The documentation for ESAPI is sparse at best. Here are a few nuggets that might help:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.