10 Excellent Ways to Secure Your Spring Boot Application - The Secure Developer 2019

10 Excellent Ways to Secure Your Spring
Boot Application
June 6, 2019
Simon Maple and Matt Raible
@sjmaple | @mraible
thesecuredeveloper.com

10 Excellent Ways…
http://bit.ly/secure-spring-boot

Use HTTPS Everywhere!
Let’s Encrypt offers free HTTPS certificates
certbot can be used to generate certificates
mkcert can be used to create localhost certificates
Spring Boot Starter ACME for automating certificates

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.requiresChannel().anyRequest().requiresSecure();
}
}

@Configuration
@Override
http.requiresChannel()
.requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null)
.requiresSecure();
}
}

10 Excellent Ways to Secure Your Spring Boot Application - The Secure Developer 2019

2. Scan Your Dependencies
for Vulnerabilities

Source: SecurityIntelligence.com
Java Struts 2 RCE Vulnerability 
CVE 2017-5638

Java Struts 2 RCE Vulnerability 
CVE 2017-5638
Source: SecurityIntelligence.com

Serverless Example: Fetch ﬁle & store in s3 
(Serverless Framework Example)
19 Lines of Code
2 Direct dependencies
19 dependencies (incl. indirect)
191,155 Lines of Code

https://snyk.io/opensourcesecurity-2019

How well do you know your dependencies?

Checking for Updates with npm
npm i -g npm-check-updates 
ncu

Checking for Updates with Maven
mvn versions:display-dependency-updates

Checking for Updates with Gradle
gradle dependencyUpdates -Drevision=release

@EnableWebSecurity
@Override
http
.csrf()
.csrfTokenRepository(
CookieCsrfTokenRepository.withHttpOnlyFalse());
}
}

5. Use a Content Security Policy to
Prevent XSS Attacks

@spring_io
#springio17
Default Spring Security Headers
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

@EnableWebSecurity
@Override
http.headers()
.contentSecurityPolicy(

@spring_io
#springio17
Better Web Site Security How-To
developer.okta.com/blog/2019/04/11/site-security-cloudﬂare-netlify

6. Use OpenID Connect for
Authentication

@spring_io
#springio17
Spring Security OIDC Conﬁguration
spring:
security:
oauth2:
client:
registration:
okta:
client-id: {clientId}
client-secret: {clientSecret}
provider:
okta:
issuer-uri: https://{yourOktaDomain}/oauth2/default

OIDC Authentication Demo
@Grab('spring-boot-starter-oauth2-client')
@RestController
class Application {
@GetMapping('/')
String home(java.security.Principal user) {
‘Hello ' + user.name
}
}

Works with Spring WebFlux
developer.okta.com/blog/2018/11/26/spring-boot-2-dot-1-oidc-oauth2-reactive-apis

And JHipster!
developer.okta.com/blog/2019/04/04/java-11-java-12-jhipster-oidc

7. Managing Passwords?
Use Password Hashing!

hash(“TSD”) = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3
Deterministic

One-way function
hash(“TSD”) =3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3
unhash(“3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3”) = ???

It should not be predictable
hash(“TSD0”) = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3
hash(“TSD1”) = 98eadd540e6c0579a1bcbe375c8d1ae2863beacdfb9af803e5f4d6dd1f8926c2
hash(“TSD2”) = 665ec59d7fb01f6070622780e744040239f0aaa993eae1d088bc4f0137d270ef
hash(“TSD3”) = 7ae89eb10a765ec2459bee59ed1d3ed97dbb9f31ec5c7bd13d19380bc39f5288

One to one mapping
hash(“123”) != 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3

@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
Hashed passwords in Spring

@Autowired
private PasswordEncoder passwordEncoder;
public String hashPassword(String password) {
return passwordEncoder.encode(password);
}
Hashed passwords in Spring

https://github.com/awslabs/git-secrets

<dependencies>
<dependency>
<groupId>org.springframework.vault</groupId>
<artifactId>spring-vault-code</artifactId>
<version>2.2.RELEASE</version>
</dependency>
</dependencies>
Spring Vault

Spring Vault
@Value(”${password}”)
String password;

9. Test Your App with OWASP’s ZAP

OWASP Zed Attack Proxy
Two approaches: Spider and Active Scan

Spider starts with a seed of URLs

Active Scan records a session then plays it back, scanning for known
vulnerabilities

Learn More about ZAP
Homepage

www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

GitHub

github.com/zaproxy/zaproxy

Twitter

twitter.com/zaproxy

10. Have Your Security Team
do a Code Review

Code Review topics
1. Identify and validate any third party input
2. Never store credentials as code/conﬁg
3. Test for new security vulnerabilities in third-party open source dependencies.
4. Authenticate inbound requests
5. Enforce the least privilege principle
6. Prefer whitelist over blacklist
7. Handle sensitive data with care
8. Do not allow back doors in your code
9. Protect against well-known attacks
10.Statically test your source code on every PR, automatically

10 Excellent Ways to Secure Spring Boot
1. Use HTTPS

2. Scan dependencies

3. Dependencies up-to-date

4. Enable CSRF protection

5. Use a Content Security Policy

6. Use OIDC

7. Hash passwords

8. Store secrets securely

9. Test with OWASP's ZAP

10.Code review with experts

snyk.io/blog/spring-boot-security-best-practices

Bonus: Don’t Allow Your
Lack of Security to be Disturbing

Questions?
Keep in touch!

@sjmaple

@mraible

Presentation

speakerdeck.com/mraible

Code

github.com/oktadeveloper

10 Excellent Ways to Secure Your Spring Boot Application - The Secure Developer 2019

Recommended

More Related Content

What's hot (20)

Similar to 10 Excellent Ways to Secure Your Spring Boot Application - The Secure Developer 2019 (20)

More from Matt Raible (20)

Recently uploaded (20)

10 Excellent Ways to Secure Your Spring Boot Application - The Secure Developer 2019