Java Web: Proactive and passive way to detect secure frameworks

Source: Internet
Author: User
Tags java web csrf attack

For some sensitive systems such as payments, transactions need to be reinforced, it is necessary to take into account possible attack situations to prevent, so there is such a simple security framework. In the code of the predecessor (see: http://blog.csdn.net/zhongweijian/article/details/8680737) I greatly refactor to better understand Java Web security implementation measures.

Source code: Http://git.oschina.net/sp42/ajaxjs/tree/master/ajaxjs-security?dir=1&filepath=ajaxjs-security

The framework adds some input and output filtering based on the Sevlet filter and several httpservletrequest/httpservletresponse overrides. The following table shows which attacks can be supported.

function corresponding class name Load Mode Init-param
XSS filtering Com.ajaxjs.web.security.wrapper.xss_request/xss_response Wrapper Enablexssfilter
Header CLRF Filter Com.ajaxjs.web.security.wrapper.CLRF_Response Wrapper Enableclrf_filter
Cookie Key verification and size verification Com.ajaxjs.web.security.wrapper.cookierequest/cookieresponse Wrapper Cookiewhitelist (Configure white list)
File Upload suffix verification Com.ajaxjs.web.security.wrapper.UploadRequest Wrapper Uploadfilewhitelist (Configure white list)
CSRF attack Com.ajaxjs.web.security.filter.CSRF Filter Encrycookiekey (config key)
Session is stored in a cookie via encryption Com.ajaxjs.web.security.filter.EncrySessionInCookie Filter Encrycookiekey (config key)
POST Whitelist/blacklist mechanism verification Com.ajaxjs.web.security.filter.Post Filter Postwhitelist/postblacklist (Configure Whitelist/blacklist)
Referer Route Detection Com.ajaxjs.web.security.filter.RefererFilter Filter Refererfilter (config key)

All detections are handled by Configloader for read configuration and startup. Whether or not a feature is started depends on whether it is configured or not, and if so, the function point takes effect and is not enabled. The Init-param on the table corresponds to what is configured in Web. Xml.

Load mode refers to the active detection in the filter, generally the execution of the check () method, the incoming request/response can be, and wrapper refers to the passive way detection, filtering, specifically, the Java API way to cover to include detection means, similar to the design mode Te The Mplate template method allows the caller to add new logic without changing the API. In particular, you can learn about the Httpservletrequestwrapper/httpservletresponsewrapper two native APIs.

How to use: Introduce a JAR package and add the Web. XML configuration.

[HTML]View Plaincopy print?
  1. <!--Defense--
  2. <filter>
  3. <filter-name>securityfilter</filter-name>
  4. <filter-class>com.ajaxjs.web.security.configloader</filter-class>
  5. <!--whether to start XSS filtering --
  6. <init-param>
  7. <param-name>enablexssfilter</param-name>
  8. <param-value>true</param-value>
  9. </init-param>
  10. <!--whether to start CLRF filter --
  11. <init-param>
  12. <param-name>enableclrf_filter</param-name>
  13. <param-value>true</param-value>
  14. </init-param>
  15. <!--Session is stored encrypted to a cookie --
  16. <init-param>
  17. <param-name>encrycookiekey</param-name>
  18. <param-value>1234567887654321</param-value>
  19. </init-param>
  20. <!--Cookies White list mechanism verification and size verification --
  21. <init-param>
  22. <param-name>cookiewhitelist</param-name>
  23. <param-value>id,jessionid,name,clrf</param-value>
  24. </init-param>
  25. <!--file Upload suffix white list filter --
  26. <init-param>
  27. <param-name>uploadfilewhitelist</param-name>
  28. <param-value>jpg,png,doc,xls</param-value>
  29. </init-param>
  30. <!--CSRF attack filter --
  31. <init-param>
  32. <param-name>csrf_filter</param-name>
  33. <param-value>true</param-value>
  34. </init-param>
  35. <!--POST Whitelist/blacklist mechanism validation (regular match supported)--
  36. <init-param>
  37. <param-name>postwhitelist</param-name>
  38. <param-value>/d/sssecurity,/user/aaa/name*</param-value>
  39. </init-param>
  40. <init-param>
  41. <param-name>postblacklist</param-name>
  42. <param-value>true</param-value>
  43. </init-param>
  44. <!--Configure Security exception after the jump URL parameter --
  45. <init-param>
  46. <param-name>redirecturlt</param-name>
  47. <param-value>http://localhost:8080/[0-9a-za-z]*,http://www.taobao.com/[0-9a-za-z]*</ param-value>
  48. </init-param>
  49. </filter>
  50. <filter-mapping>
  51. <filter-name>securityfilter</filter-name>
  52. <url-pattern>/*</url-pattern>
  53. </filter-mapping>
  54. <!--//-
<!--defense--><filter><filter-name>securityfilter</filter-name><filter-class> com.ajaxjs.web.security.configloader</filter-class><!--Whether to start XSS filtering--><init-param>< Param-name>enablexssfilter</param-name><param-value>true</param-value></init-param> <!--whether to start CLRF filter--><init-param><param-name>enableclrf_filter</param-name><param-value >true</param-value></init-param><!--Session encrypted to Cookie--><init-param>< param-name>encrycookiekey</param-name><param-value>1234567887654321</param-value></ init-param><!--Cookies white list mechanism validation and size verification--><init-param><param-name>cookiewhitelist</ param-name><param-value>id,jessionid,name,clrf</param-value></init-param><!--file upload suffix white list Filter--><init-param><param-name>uploadfilewhitelist</param-name><param-value>jpg,png, Doc,xls</param-value></init-param><!--CSRF Attack filter--><init-param><param-name>csrf_filter</param-name>< param-value>true</param-value></init-param><!--POST Whitelist/blacklist mechanism validation (regular match support)--><init-param ><param-name>postwhitelist</param-name><param-value>/d/sssecurity,/user/aaa/name*</ param-value></init-param><init-param><param-name>postblacklist</param-name>< param-value>true</param-value></init-param><!--Configure Security exception after the jump URL parameter--><init-param ><param-name>redirecturlt</param-name><param-value>http://localhost:8080/[0-9a-za-z]*, Http://www.taobao.com/[0-9a-za-z]*</param-value></init-param></filter><filter-mapping> <filter-name>securityfilter</filter-name><url-pattern>/*</url-pattern></ filter-mapping><!--//-

Specific defense principles can be found in my previous blog "Network Information system security detection scheme design (upper and lower)".

It is important to note that SQL injection is not considered in this scenario because SQL injection is done at the DAO level.

Java Web: Proactive and passive way to detect secure frameworks

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.