Could somebody please demonstrate a small code for spring security for StrictHttpFirewall and Websecurity classes? I want to defend against XSS attacks, SQL injections, be it POST or GET, on all the URLs. Where should we instantiate and inject these beans?


All of the attacks you referenced can all be mitigated with user input validation.

Don't want your site attacking another site? Then don't allow certain command characters so they can't construct scripts do to do. Do explicit checking to search for commong behaviors for XSS. Search for the tags and Javascript code.

SQL Injection can also be mitigated by user input validation. Make sure that if you're looking for a persons name in a variable, you're only allowing characters appropriate for the names you want (no extraneous characters: <, >, $, %, *, etc.). You can also help mitigate this by using a database user who has catered access to the tables in question: SELECT and INSERT but not DELETE, etc.

  • but still, if spring security gives it inbuilt then it would be nice to implement it – Saurabh Kedia Oct 29 '18 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.