jQuery in Action, 3rd edition
The moose likes Servlets and the fly likes Application Security Ideas Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Servlets
Bookmark "Application Security Ideas" Watch "Application Security Ideas" New topic

Application Security Ideas

vjy chin
Ranch Hand

Joined: Feb 17, 2005
Posts: 279

I am starting on an application and I am thinking about some security issues that I need to take care.

The main thing I need to take care is that the servlet should be accessed from my site only. No other site or direct linking should be possible. I saw about the Http referrer, but I read the review that it can be spoofed easily.

What are the other options that I need to consider? The users will not be logged in always. They can come to just browse. So I cannot always use the login information. Let me know other things that I need to consider security wise.

Any help in this regard is greatly appreciated.


P.S. I am not sure if this is the right forum. Moderators, Please move it to the right one. Thanks
Ulf Dittmer

Joined: Mar 22, 2005
Posts: 42965
The referrer would in any case be unreliable - it's not necessarily present even when not spoofed.

The remote IP address would be a better way. You can get it from the HttpServletRequest.getRemoteAddr() method.
Nicholas Jordan
Ranch Hand

Joined: Sep 17, 2006
Posts: 1282
MD-5 hashing. You give out a few passwords, which you have already hashed. You put the hashes, not the pw, in either a configuration file or an application reachable file. This approach has a major drawback in that people do not want to be bothered with them so they get lost or forgotten - if you only have the md-5 hash of the password there is no reasonable way to recover the password. The approch there is to have one machine on site that can generate a new password easily and that can readily access the Tomcat. I have given this a lot of thought and the only reliable solution I have been able to devise is a thumb-drive that has a thumb print reader in it, with long random strings for username/password pairs.

Once again,if you lose the thumb-drive problems occur but with this approach they are more like a self inflicted denial of service. There is a commonly used approch called X.509 Certificates, these can be installed on the machines you want to use. This is stronger and the likelyhood that an out of site machine can break the certificate store is unlikely in most settings. That approch gets very involved and I would not consider it except on medium to large sites. I instead am planning to write random questions using something only authorized users are likely to know, these questions can be written into the html the servlet generates.

Another more immediate issue is to use what is called FORMS - the servlets api has a remarkably powerful tool for using FORMS. You can ask in HTML and JavaScript if you need to know what forms are. If you need any security beyond what this can provide, I suggest you post in the Security form and just be aware of needing to disentangle the servlet issues from the security issues.

That is not always easy to do.
[ February 16, 2008: Message edited by: Nicholas Jordan ]

"The differential equations that describe dynamic interactions of power generators are similar to that of the gravitational interplay among celestial bodies, which is chaotic in nature."
Ben Souther

Joined: Dec 11, 2004
Posts: 13410

This doesn't really address the original poster's concern.
He wants to insure that someone else doesn't link directly to his images or access any of his pages unless they get there by clicking one of his links.

Java API J2EE API Servlet Spec JSP Spec How to ask a question... Simple Servlet Examples jsonf
vjy chin
Ranch Hand

Joined: Feb 17, 2005
Posts: 279
Thanks for all the replies.

As Ben said my first aim is to prevent users access any information other that through my page. Once that is taken care I will look into other options.

Nicholas, thanks for your explanation. I will try to read about it more and think if it will be feasible for us.

Again thanks.
Nicholas Jordan
Ranch Hand

Joined: Sep 17, 2006
Posts: 1282
I read both of your comments on my suggestions. I cannot see what is to prevent someone with deep technical skills from spoofing a link with a handy editor. Admittedly I gave a deep water treatment of the issue but what is to prevent someone else from linking directly to his images or access any of his pages unless original poster implements suggestions along this design basis ? Anyone with an editor and ten minutes could ( if they see the link from beyond the network ) write an html link and click in.

{ please, do not let this become a distraction - original poster states that he has enough to work with. I just do not see how to effectively accomplish stated goals without the above work }
I agree. Here's the link: http://aspose.com/file-tools
subject: Application Security Ideas
It's not a secret anymore!