I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application relatively more secured against potential threats.

P.S. : I'm using JSF 2.0 as the front-end development framework in my web application.

  • For internal/external use? Customers/employees?
    – Steve
    Commented Aug 4, 2011 at 14:46
  • for external use.. a web app that is open to a general audience similar to a social networking applications Commented Aug 4, 2011 at 14:49

2 Answers 2


Check out OWASP's ESAPI (Enterprise Security API).

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.

While it is ported to several languages and frameworks, it started as a Java EE project. It's a very large and flexible framework, should meet most of your needs.

And as far as authentication and user management goes, strongly consider using OpenID (or something like that), so you dont have to manage it at all. Depending on your usecases and userbase, this can be a huge benefit, to you AND your users.

  • Thanks ! What do you think about Apache Shiro. I just heard some good comments about it. Commented Aug 4, 2011 at 20:27
  • Dont really know Apache Shiro, so I can't comment on it... But OWASP ESAPI is considered the goto package.
    – AviD
    Commented Aug 5, 2011 at 7:25

If you still have the freedom to choose the web application framework you are using, I can recommend web2py. It has built-in support for authentication, log-in management, and many other security needs. It was designed right from the get-go to make many security problems (e.g., XSS, SQL injection, session management attacks, etc.) nearly impossible. And, as a bonus, it is beautiful, clean, and easy-to-learn.

web2py: Give it a try.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .