ESAPI = Enterprise Security API

文章目錄

• What is ESAPI?
• Why ESAPI?
• Where did ESAPI come from?

下面是OWASP裡的說明，其實簡單一點來說，ESAPI就是為編寫出更加安全的代碼設計出來的一些API，方便使用者調用，從而方便的編寫安全的代碼。它本身是開源的，同時提供JAVA版本和.NET版本。

代碼：http://code.google.com/p/owasp-esapi-java/

ESAPI介紹的PPT：http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt

顯示了提供的API與OWASP列出的10個安全問題的涵蓋關係：

 

 ---------------------------------------------------------  來自 owasp --------------------------------------------------------------------------

Watch the Video

What is ESAPI?

The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

Why ESAPI?

Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

Where did ESAPI come from?

The OWASP ESAPI project is led by Jeff Williams, who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the ESAPI PowerPoint presentation