{"id":2988857,"url":"https://github.com/dschadow/JavaSecurity","last_synced_at":"2025-08-09T23:31:31.925Z","repository":{"id":12776169,"uuid":"15449667","full_name":"dschadow/JavaSecurity","owner":"dschadow","description":"Java web and command line applications demonstrating various security topics","archived":false,"fork":false,"pushed_at":"2024-10-23T06:38:09.000Z","size":2615,"stargazers_count":236,"open_issues_count":0,"forks_count":70,"subscribers_count":14,"default_branch":"main","last_synced_at":"2024-10-24T22:59:19.493Z","etag":null,"topics":["appsec","cryptography","csp","csrf","esapi","google-tink","java","java-security","java-web","owasp","security","security-topics","spring","spring-boot","spring-security","xss"],"latest_commit_sha":null,"homepage":"https://blog.dominikschadow.de","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dschadow.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security-header/certificates/keystore.jks","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-12-26T09:19:39.000Z","updated_at":"2024-10-24T01:34:17.000Z","dependencies_parsed_at":"2023-02-16T11:15:50.469Z","dependency_job_id":"aa1e441a-71a7-44d3-8f60-0e1a80219a24","html_url":"https://github.com/dschadow/JavaSecurity","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dschadow%2FJavaSecurity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dschadow%2FJavaSecurity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dschadow%2FJavaSecurity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dschadow%2FJavaSecurity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dschadow","download_url":"https://codeload.github.com/dschadow/JavaSecurity/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":229338667,"owners_count":18057522,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appsec","cryptography","csp","csrf","esapi","google-tink","java","java-security","java-web","owasp","security","security-topics","spring","spring-boot","spring-security","xss"],"created_at":"2024-01-31T03:28:46.292Z","updated_at":"2024-12-12T05:30:22.533Z","avatar_url":"https://github.com/dschadow.png","language":"Java","readme":"Java Security\n============\nThis repository contains several Java web applications and command line applications covering different security topics. Have a look at my [slides](https://blog.dominikschadow.de/events) and [publications](https://blog.dominikschadow.de/publications) covering most applications in this repository.\n\n# Requirements\n- [Java 21](https://dev.java)\n- [Maven 3](http://maven.apache.org)\n- [Mozilla Firefox](https://www.mozilla.org) (recommended, some demos might not be fully working in other browsers)\n- [Docker](https://www.docker.com) (required for running the sample applications as Docker containers) \n\n# Web Applications in Detail\nSome web applications contain exercises, some are only there to inspect and learn. Instructions are provided in detail on the start page of each web application.\n\nSome web applications are based on [Spring Boot](http://projects.spring.io/spring-boot) and can be started via the **main** method in the **Application** class or via **mvn spring-boot:run** in the project directory. Spring Boot projects can be launched via `docker run -p 8080:8080 dschadow/[PROJECT]` after the image has been created using `mvn spring-boot:build-image`. The other web applications either contain an embedded **Tomcat7 Maven plugin** which can be started via **mvn tomcat7:run-war**, or an embedded **Jetty Maven plugin** which can be started via **mvn jetty:run-war**.\n\n## access-control-spring-security\nAccess control demo project utilizing [Spring Security](http://projects.spring.io/spring-security) in a Spring Boot application. Shows how to safely load user data from a database without using potentially faked frontend values. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## csp-spring-security\nSpring Boot based web application using a Content Security Policy (CSP) header. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## csrf-spring-security\nCross-Site Request Forgery (CSRF) demo project based on Spring Boot preventing CSRF in a web application by utilizing [Spring Security](http://projects.spring.io/spring-security). After launching, open the web application in your browser at **http://localhost:8080**. \n\n## csrf\nCross-Site Request Forgery (CSRF) demo project preventing CSRF in a JavaServer Pages (JSP) web application by utilizing  the [Enterprise Security API (ESAPI)](https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API). After launching, open the web application in your browser at **http://localhost:8080/csrf**.\n\n## direct-object-references\nDirect object references (and indirect object references) demo project using Spring Boot and utilizing the [Enterprise Security API (ESAPI)](https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API). After launching, open the web application in your browser at **http://localhost:8080**.\n\n## intercept-me\nSpring Boot based web application to experiment with [OWASP ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) as intercepting proxy. Target is to receive **SUCCESS** from the backend. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## security-header\nSecurity response header demo project which applies **X-Content-Type-Options**, **Cache-Control**, **X-Frame-Options**, **HTTP Strict Transport Security (HSTS)**, **X-XSS-Protection** and **Content Security Policy (CSP)** (Level 1 and 2) headers to HTTP responses. After launching, open the web application in your browser at **http://localhost:8080/security-header** or **https://localhost:8443/security-header**.\n\n## security-logging\nSpring Boot based web application utilizing the [OWASP Security Logging Project](https://www.owasp.org/index.php/OWASP_Security_Logging_Project). Demonstrates how to log security relevant incidents in a log file. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## session-handling-spring-security\nSession handling demo project based on Spring Boot utilizing [Spring Security](http://projects.spring.io/spring-security) and [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot) to secure [Spring](http://spring.io) configuration (property) files. Shows how to restrict access to resources (URLs), how to apply method level security and how to securely store and verify passwords. Uses Spring Security for all security related functionality. Requires a system property (or environment variable or command line argument) named **jasypt.encryptor.password** with the value **session-handling-spring-security** present on startup. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## session-handling\nSession handling demo project using plain Java. Uses plain Java to create and update the session id after logging in. Requires a web server with Servlet 3.1 support. After launching, open the web application in your browser at **http://localhost:8080/session-handling**.\n\n## sql-injection\nSpring Boot based web application to experiment with normal (vulnerable) statements, statements with escaped input, and prepared statements. After launching, open the web application in your browser at **http://localhost:8080**.\n\n## xss\nCross-Site Scripting (XSS) demo project preventing XSS in a JavaServer Pages (JSP) web application by utilizing input validation, output escaping with [OWASP Java Encoder](https://www.owasp.org/index.php/OWASP_Java_Encoder_Project) and the Content Security Policy (CSP). After launching, open the web application in your browser at **http://localhost:8080/xss**.\n\n# Command Line Applications in Detail\nThe following projects demonstrate crypto usage in Java with different libraries. Each project contains one or more JUnit **test** classes to test various functionalities of the demo project.\n\n## crypto-hash\nCrypto demo using Java to hash passwords with different hashing algorithms.\n\n## crypto-java\nCrypto demo using plain Java to encrypt and decrypt data with asymmetric (RSA) and symmetric (AES) algorithms as well as to sign and verify data (DSA).\n\n## crypto-shiro\nCrypto demo using [Apache Shiro](http://shiro.apache.org) to encrypt and decrypt data with symmetric (AES) algorithms as well as hash data (passwords). \n\n## crypto-tink\nCrypto demo using [Google Tink](https://github.com/google/tink) to encrypt and decrypt data with asymmetric and hybrid encryption, MAC and digital signatures. Depending on the demo, keys are either generated on the fly or stored/loaded from the keysets' directory. The **AWS KMS** samples (classes with AwsKms in their names) require a configured AWS KMS with an enabled master key.\n\n## Meta\n![Build](https://github.com/dschadow/JavaSecurity/workflows/Build/badge.svg) [![codecov](https://codecov.io/gh/dschadow/JavaSecurity/branch/main/graph/badge.svg?token=3raAUutQ8l)](https://codecov.io/gh/dschadow/JavaSecurity) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)","funding_links":[],"categories":["Java (504)","Java"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdschadow%2FJavaSecurity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdschadow%2FJavaSecurity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdschadow%2FJavaSecurity/lists"}