Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [spring-framework]

The Spring Framework is an application development framework for Java.

0
votes
0answers
19 views

Persist Login Session in Spring Application using OAuth

I am trying out a Amazon like scenario where in different areas have different session timeouts and based on that user will be prompted for login if session for that particular area is expired. Like ...
0
votes
0answers
21 views

How do I get a CSRF token from Spring, to send up to my application?

All the Spring documentation I've seen says how to use CSRF tokens with Thymeleaf or JSP. I have plain html and javascript files, and a java back-end. First, how do I get the CSRF token from Spring ...
0
votes
1answer
47 views

Anti-CSRF scanner still alerts after adding _csrf token to login form

I am working on a Spring MVC project. I applied CSRF Token to login form by enabling and using in Spring security. When I go to the login page, I can see that a CSRF Token generated automatically ...
0
votes
1answer
44 views

Storing vault read token securely

I have PCF spring boot application which needs to access the vault server to get the credentials to create datasource during startup. Right now we are hard coding the app role id and secret id in the ...
1
vote
1answer
51 views

Remote detection of spring framework

I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security. Is there any kind of analysis on HTTP headers that can provide ...
1
vote
0answers
57 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
0
votes
1answer
210 views

WebSecurity and StrictHttpFirewall in spring

Could somebody please demonstrate a small code for spring security for StrictHttpFirewall and Websecurity classes? I want to defend against XSS attacks, SQL injections, be it POST or GET, on all the ...
0
votes
1answer
46 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
3
votes
1answer
646 views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
1answer
102 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
4
votes
2answers
5k views

CSRF token not bound to session in Spring application

We're developing a Spring appication with Spring Security. After doing some pen testing, one of the test results was a vulnerability: Cross-Site Request Forgery Token is not bound to user context. ...
3
votes
1answer
5k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
30
votes
2answers
6k views

Is emailing sign in links bad practice?

In my Spring application, I was planning to remove passwords from the authentication process by sending a "magic sign-in link" to a user's email address. However, in this question Rob Winch (lead of ...
0
votes
2answers
2k views

What are the best practices to secure an Angular & Spring web project?

I'm creating WEB project in Angular4 and Spring. This is educational project for my learning. I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to ...
1
vote
0answers
295 views

Securing a B2B (server to server) multi-tenant REST API [closed]

I am developing a B2B multi-tenant REST API which will be invoked by tenant’s (wallet provider) server application (secure or confidential client) on to perform some operations on its user’s accounts. ...
3
votes
1answer
51 views

How does one determine what strength parameter to pass to BCryptEncoder (default is 10) in Spring Java?

The spring documentation doesn't say much, just that the default strength is 10. How does one determine when using increased strength might be warranted and what the trade off is?
1
vote
1answer
545 views

Am I missing any loopholes with my current session managment?

I'm building a site with Spring, which requires authentication in order for accessing certain pages. The site is actually composed of a client host, which render the views and handle the data binding,...
6
votes
2answers
4k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
1
vote
0answers
34 views

securing a REST end point for 3rd part applications to connect to

Im generating a REST database service for an android application to connect to, and have little to no security experience. the service currently uses OAuth2 to secure a web front end with a Spring ...
0
votes
1answer
1k views

Passing an encrypted value in Java Spring REST API query string

I am using set of REST APIs build using Java Spring. I need to pass an encrypted value from client to a REST service. The client invokes a GET request. My question is how secure and efficient it is ...
4
votes
2answers
801 views

Securing Micro Services Architecture internally

I am implementing a solution with set of Micro Services (Spring Rest Services) with Rabbit MQ as the message broker. The Edge server is Authenticated using OAuth based Identity server. Internal ...
0
votes
0answers
1k views

Store a symmetric key in Java Keystore

It would be great if someone can let me know how exactly we can store a symmetric key in a Java Keystore. It is common to use store key pairs in Keystores. But I need to store a symmetric key and ...
0
votes
1answer
681 views

Is it safe to monitor java process via JMX

I'm using java application server behind web application firewall (nginx with TLS & mod_security). Java application is running in Internal network segment behind WAF. Requests from the Internet ...
0
votes
1answer
499 views

Restrict access to public URL many times

I have such situation. Imagine there is a public service (URL). What we don't want, is for someone, to be able to access this URL many times in short period of time, because they will be able to block ...
2
votes
1answer
184 views

Authentication Token storing after database authentication

I've worked on a Spring 4 MVC RESTful backend application. We authenticate to an OpenAM server, and a lengthy token is stored in a cookie on the front-end. The front-end takes the token out of the ...
4
votes
0answers
1k views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...