Skip to main content

How to prevent CSRF?

Very informative document about preventing CSRF (Cross Site Request Forgery) from the web application and Restful Services.

http://seclab.stanford.edu/websec/csrf/csrf.pdf 


Comments

Post a Comment

Popular posts from this blog

remove(unset) property in a property file using ANT PropertyFile task

Using PropertyFile task we can edit the property file during ANT build. Edit property value are very easy and can find here details. http://ant.apache.org/manual/Tasks/propertyfile.html but delete a property or comment a property is the tricky one. If we are using latest ant version (1.8.1 or later), we can delete a property like below. <propertyfile file="my.properties" comment="My properties">   < entry  key="propertykey" operation="del"/> < /propertyfile> but the older version that is before 1.8.1 don't have operation called " del ", if we run the command in lower version ant, we will get a error says undefined operation "del".      there is workaround instead deleting a property we can comment that property using ant's replace command. < replace file="sample.properties">                      < replacefilter token="propertykey" value="#propert...
Post a Comment
Read more

Secure Coding Guidelines for the Java Programming Language

http://www.oracle.com/technetwork/java/seccodeguide-139067.html Secure Coding Guidelines for the Java Programming Language, Version 3.0 Introduction 0 Fundamentals Guideline 0-1 Prefer to have obviously no flaws than no obvious flaws Guideline 0-2 Design APIs to avoid security concerns Guideline 0-3 Avoid duplication Guideline 0-4 Restrict privileges Guideline 0-5 Establish trust boundaries Guideline 0-6 Contain sensitive data Guideline 0-7 Particular data format and API issues Guideline 0-7a Avoid dynamic SQL Guideline 0-7b XML and HTML generation requires care Guideline 0-7c Restrict XML inclusion Guideline 0-7d Take care interpreting untrusted code 1 Accessibility and Extensibility Guideline 1-1 Limit the accessibility of classes,interfaces, methods, and fields Guideline 1-1a Limit the accessibility of packages Guideline 1-1b Isolate unrelated code Guideline 1-2 Limit the extensibility of classes and methods Guideline 1-3 Understand how a su...
Post a Comment
Read more

Disable hibernate Optimistic Lock for specific scenario

Optimistic Lock gives more control on concurrent modification on data. That can be achieved very easily in hibernate using @Version column. But in some cases we may have to avoid concurrency check, example background process. To disable Optimistic lock set OptimisticLockMode as NONE for entity class while hibernate is initiating. We can't remove version column that needs Database changes and ORM changes. In this way we can disable Optimistic Lock by code. implement "org.hibernate.event.Initializable" interface override the below method.     @Override     public void initialize(Configuration cfg) {         Iterator<?> persistentClassIterator = cfg.getClassMappings();         while (persistentClassIterator.hasNext()) {             PersistentClass persistentClass = PersistentClass.class.cast(persistentClassIterato...
Post a Comment
Read more