Test Driven Application Security
summary
Demonstration uses Java 21 with Spring and Spring Security and automated tests in JUnit 5 with AssertJ to turn common OWASP Top 10 failures into reproducible checks. System tests assert TLS 1.3, security headers and token audience and scope validation; unit tests add domain primitives, a permission service, DTO mapping to avoid data leakage, and early-abort authorization in the service layer. Several initially green happy-path tests hide missing negative cases; fixing five failing tests eliminates idor and leaking internal fields.
AI-written summary · about
chapters (17)
- 0:00Test driven app security intro
- 1:06Why penetration tests keep finding the same vulnerabilities
- 4:15Security as nonfunctional req
- 8:10Secure API with six defenses
- 11:42System tests for auth and authz
- 14:39Health endpoints and error handling
- 17:51TLS and security headers tests
- 19:58Controller auth and data unit tests
- 23:15Permission transformation tests
- 27:17Domain auth and validation tests
- 27:59Input validation with primitives
- 31:53Fine-grained access control refactor
- 35:28Fixing failing security tests
- 38:58Defense in depth with annotations
- 39:19Summary and key takeaways
- 40:00Why security tests matter
- 41:26Resources and closing
related talks
53mTest Driven Application Security
44mShift-Left-Security with the Security Test Pyramid
26mSecurity Test Driven Development
49m10 Excellent Ways to Secure Your Spring Boot Application
49mThe Security Testing Pyramid for Developers
27mHow to Start Security Testing Without Fear
57mShift Left Security with the Security Test Pyramid
02h 58mOverview of Testing in Our Applications