Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application relatively more secured against potential threats.
P.S. : I'm using JSF 2.0 as the front-end development framework in my web application.
Check out OWASP's ESAPI (Enterprise Security API).
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.
While it is ported to several languages and frameworks, it started as a Java EE project. It's a very large and flexible framework, should meet most of your needs.
And as far as authentication and user management goes, strongly consider using OpenID (or something like that), so you dont have to manage it at all. Depending on your usecases and userbase, this can be a huge benefit, to you AND your users.
If you still have the freedom to choose the web application framework you are using, I can recommend web2py. It has built-in support for authentication, log-in management, and many other security needs. It was designed right from the get-go to make many security problems (e.g., XSS, SQL injection, session management attacks, etc.) nearly impossible. And, as a bonus, it is beautiful, clean, and easy-to-learn.
web2py: Give it a try.
