Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application relatively more secured against potential threats.

P.S. : I'm using JSF 2.0 as the front-end development framework in my web application.

share|improve this question
For internal/external use? Customers/employees? – Steve Aug 4 '11 at 14:46
for external use.. a web app that is open to a general audience similar to a social networking applications – user01 Aug 4 '11 at 14:49

Check out OWASP's ESAPI (Enterprise Security API).

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.

While it is ported to several languages and frameworks, it started as a Java EE project. It's a very large and flexible framework, should meet most of your needs.

And as far as authentication and user management goes, strongly consider using OpenID (or something like that), so you dont have to manage it at all. Depending on your usecases and userbase, this can be a huge benefit, to you AND your users.

share|improve this answer
Thanks ! What do you think about Apache Shiro. I just heard some good comments about it. – user01 Aug 4 '11 at 20:27
Dont really know Apache Shiro, so I can't comment on it... But OWASP ESAPI is considered the goto package. – AviD Aug 5 '11 at 7:25

If you still have the freedom to choose the web application framework you are using, I can recommend web2py. It has built-in support for authentication, log-in management, and many other security needs. It was designed right from the get-go to make many security problems (e.g., XSS, SQL injection, session management attacks, etc.) nearly impossible. And, as a bonus, it is beautiful, clean, and easy-to-learn.

web2py: Give it a try.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.