Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

10 Excellent Ways to Secure Your Spring Boot Application - Devoxx Belgium 2019

16 views

Published on

Spring Boot is an excellent way to build Java applications with the Spring Framework. If you’re developing apps that handle sensitive data, you should make sure they’re secure.

This session will cover HTTPS, dependency checking, CSRF, using a CSP to prevent XSS, OIDC, password hashing, and much more!

You’ll learn how to add these features to a real application, using the Java language you know and love.

* YouTube video: https://www.youtube.com/watch?v=PpqNMhe4Bd0
* Blog post: https://developer.okta.com/blog/2018/07/30/10-ways-to-secure-spring-boot
* Cheat sheet: https://snyk.io/blog/spring-boot-security-best-practices/

Published in: Software
  • Be the first to comment

  • Be the first to like this

10 Excellent Ways to Secure Your Spring Boot Application - Devoxx Belgium 2019

  1. 1. Brian Vermeer and Matt Raible 10 Excellent Ways to Secure Your Spring Boot Application @BrianVerm | @mraible ��
  2. 2. 10 Excellent Ways... https://bit.ly/secure-spring-boot
  3. 3. 1. Use HTTPS
  4. 4. Use HTTPS Everywhere! 4 Let’s Encrypt offers free HTTPS certificates certbot can be used to generate certificates mkcert can be used to create localhost certificates Spring Boot Starter ACME for automating certificates
  5. 5. howhttps.works
  6. 6. @Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel().anyRequest().requiresSecure(); } }
  7. 7. @Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.requiresChannel() .requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null) .requiresSecure(); } }
  8. 8. 2. Scan Dependencies
  9. 9. Java Struts 2 RCE Vulnerability CVE 2017-5638 Source: SecurityIntelligence.com
  10. 10. Your App
  11. 11. Your App Your Code
  12. 12. Serverless Example: Fetch file & store in S3 'use strict'; const fetch = require('node-fetch'); const AWS = require('aws-sdk'); // eslint-disable-line import/no-extraneous-dependencies const s3 = new AWS.S3(); module.exports.save = (event, context, callback) => { fetch(event.image_url) .then((response) => { if (response.ok) { return response; } return Promise.reject(new Error( `Failed to fetch ${response.url}: ${response.status} ${response.statusText}`)); }) .then(response => response.buffer()) .then(buffer => ( s3.putObject({ Bucket: process.env.BUCKET, Key: event.key, Body: buffer, }).promise() )) .then(v => callback(null, v), callback); }; 19 Lines of Code https://github.com/serverless/examples/tree/master/aws-node-fetch-file-and-store-in-s3
  13. 13. Serverless Example: Fetch file & store in S3 'use strict'; const fetch = require('node-fetch'); const AWS = require('aws-sdk'); // eslint-disable-line import/no-extraneous-dependencies const s3 = new AWS.S3(); module.exports.save = (event, context, callback) => { fetch(event.image_url) .then((response) => { if (response.ok) { return response; } return Promise.reject(new Error( `Failed to fetch ${response.url}: ${response.status} ${response.statusText}`)); }) .then(response => response.buffer()) .then(buffer => ( s3.putObject({ Bucket: process.env.BUCKET, Key: event.key, Body: buffer, }).promise() )) .then(v => callback(null, v), callback); }; 19 Lines of Code 2 Direct dependencies https://github.com/serverless/examples/tree/master/aws-node-fetch-file-and-store-in-s3 { "dependencies": { "aws-sdk": "^2.7.9", "node-fetch": "^1.6.3" } }
  14. 14. Serverless Example: Fetch file & store in S3 'use strict'; const fetch = require('node-fetch'); const AWS = require('aws-sdk'); // eslint-disable-line import/no-extraneous-dependencies const s3 = new AWS.S3(); module.exports.save = (event, context, callback) => { fetch(event.image_url) .then((response) => { if (response.ok) { return response; } return Promise.reject(new Error( `Failed to fetch ${response.url}: ${response.status} ${response.statusText}`)); }) .then(response => response.buffer()) .then(buffer => ( s3.putObject({ Bucket: process.env.BUCKET, Key: event.key, Body: buffer, }).promise() )) .then(v => callback(null, v), callback); }; 19 Lines of Code 2 Direct dependencies 19 dependencies (incl. indirect) https://github.com/serverless/examples/tree/master/aws-node-fetch-file-and-store-in-s3 { "dependencies": { "aws-sdk": "^2.7.9", "node-fetch": "^1.6.3" } }
  15. 15. Serverless Example: Fetch file & store in S3 'use strict'; const fetch = require('node-fetch'); const AWS = require('aws-sdk'); // eslint-disable-line import/no-extraneous-dependencies const s3 = new AWS.S3(); module.exports.save = (event, context, callback) => { fetch(event.image_url) .then((response) => { if (response.ok) { return response; } return Promise.reject(new Error( `Failed to fetch ${response.url}: ${response.status} ${response.statusText}`)); }) .then(response => response.buffer()) .then(buffer => ( s3.putObject({ Bucket: process.env.BUCKET, Key: event.key, Body: buffer, }).promise() )) .then(v => callback(null, v), callback); }; 19 Lines of Code 2 Direct dependencies 19 dependencies (incl. indirect) 191,155 Lines of Code 😱 https://github.com/serverless/examples/tree/master/aws-node-fetch-file-and-store-in-s3 { "dependencies": { "aws-sdk": "^2.7.9", "node-fetch": "^1.6.3" } }
  16. 16. https://snyk.io/opensourcesecurity-2019
  17. 17. Demo
  18. 18. Matt's Life Hack: Don't fix your socks; fix your toes!
  19. 19. 3. Upgrade Libraries
  20. 20. How well do you know your dependencies? 22 Dependencies Dependency Health Indirect Dependencies Regular Commits Regular Releases
  21. 21. Check for Updates with npm npm i -g npm-check-updates ncu https://www.npmjs.com/package/npm-check-updates
  22. 22. Check for Updates with Maven mvn versions:display-dependency-updates https://www.mojohaus.org/versions-maven-plugin
  23. 23. Check for Updates with Gradle gradle dependencyUpdates -Drevision=release https://github.com/ben-manes/gradle-versions-plugin
  24. 24. 4. Enable CSRF
  25. 25. @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf() .csrfTokenRepository( CookieCsrfTokenRepository.withHttpOnlyFalse()); } }
  26. 26. Brian's Life Hack: Portable pizza oven
  27. 27. Brian's Life Hack: Portable pizza oven
  28. 28. 5. Use a CSP
  29. 29. Default Spring Security Headers Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY X-XSS-Protection: 1; mode=block
  30. 30. @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.headers() .contentSecurityPolicy("script-src 'self' " + "https://trustedscripts.example.com; " + "object-src https://trustedplugins.example.com; " + "report-uri /csp-report-endpoint/"); } }
  31. 31. https://securityheaders.com
  32. 32. https://developer.okta.com/blog/2019/04/11/site-security-cloudflare-netlify
  33. 33. Brian's Life Hack Easy anti virus system
  34. 34. Brian's Life Hack Easy anti virus system
  35. 35. 6. Use OIDC for Auth
  36. 36. OIDC Authorization Code Flow
  37. 37. Spring Security OIDC Configuration spring: security: oauth2: client: registration: okta: client-id: {clientId} client-secret: {clientSecret} provider: okta: issuer-uri: https://{yourOktaDomain}/oauth2/default
  38. 38. OIDC Authentication Demo @Grab('spring-boot-starter-oauth2-client') @RestController class Application { @GetMapping('/') String home(java.security.Principal user) { 'Hello ' + user.name } }
  39. 39. Works with Spring WebFlux https://developer.okta.com/blog/2018/11/26/spring-boot-2-dot-1-oidc-oauth2-reactive-apis
  40. 40. And JHipster! 🎉 https://developer.okta.com/blog/2019/04/04/java-11-java-12-jhipster-oidc
  41. 41. 7. Hash Passwords
  42. 42. Deterministic hash("TSD") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 hash("TSD") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 hash("TSD") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 hash("TSD") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3
  43. 43. One-way Function hash("TSD") =3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 unhash("3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3") = ???
  44. 44. It should not be predictable hash("TSD0") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 hash("TSD1") = 98eadd540e6c0579a1bcbe375c8d1ae2863beacdfb9af803e5f4d6dd1f8926c2 hash("TSD2") = 665ec59d7fb01f6070622780e744040239f0aaa993eae1d088bc4f0137d270ef hash("TSD3") = 7ae89eb10a765ec2459bee59ed1d3ed97dbb9f31ec5c7bd13d19380bc39f5288
  45. 45. One-to-one mapping hash("TSD") = 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3 hash("123") != 3c9c93e0f8eb2161e5787f7cd3e4b67f8d98fbd80b7d237cc757583b06daa3e3
  46. 46. Hashed Passwords in Spring @Bean public PasswordEncoder passwordEncoder() { return new SCryptPasswordEncoder(); }
  47. 47. Hashed Passwords in Spring @Autowired private PasswordEncoder passwordEncoder; public String hashPassword(String password) { return passwordEncoder.encode(password); }
  48. 48. Matt's Life Hack: Clean hard-to-reach places with 🐓
  49. 49. 8. Use Secure Secrets
  50. 50. https://github.com/awslabs/git-secrets
  51. 51. Spring Vault <dependencies> <dependency> <groupId>org.springframework.vault</groupId> <artifactId>spring-vault-core</artifactId> <version>2.2.0.RELEASE</version> </dependency> </dependencies>
  52. 52. Spring Vault @Value("${password}") char[] password;
  53. 53. Why char[] instead of String for password? Strings are immutable, can't wipe data String passwords can be accidentally printed https://www.baeldung.com/java-storing-passwords Printing String password -> password Printing char[] password -> [C@6e8cf4c6
  54. 54. 9. Test with ZAP
  55. 55. OWASP Zed Attack Proxy Two approaches: Spider and Active Scan Spider starts with a seed of URLs Active Scan records a session then plays it back, scanning for known vulnerabilities
  56. 56. Learn More About ZAP Homepage https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project GitHub https://github.com/zaproxy/zaproxy Twitter @zaproxy
  57. 57. 10. Security Reviews
  58. 58. Code Review Topics 1. Identify and validate any third party input 2. Never store credentials as code/config 3. Test for new security vulnerabilities in third-party open source dependencies. 4. Authenticate inbound requests 5. Enforce the least privilege principle 6. Prefer whitelist over blacklist 7. Handle sensitive data with care 8. Do not allow back doors in your code 9. Protect against well-known attacks 10. Statically test your source code on every PR, automatically
  59. 59. Java security best practices cheat sheet http://bit.ly/java-security
  60. 60. 10 Excellent Ways to Secure Spring Boot 1. Use HTTPS 2. Scan dependencies 3. Dependencies up-to-date 4. Enable CSRF protection 5. Use a Content Security Policy 6. Use OIDC 7. Hash passwords 8. Store secrets securely 9. Test with OWASP's ZAP 10. Code review with experts ��
  61. 61. https://snyk.io/blog/spring-boot-security-best-practices
  62. 62. Life Hack: Use a toilet seat for a 👌 TV dinner setup
  63. 63. Questions? 67 Keep in Touch! @mraible @BrianVerm Presentation speakerdeck.com/mraible Code github.com/oktadeveloper

×