Securing RESTful services with Spring HATEOAS and HDIV
summary
Integration of Spring HATEOAS with the HDIV framework enforces server-defined hypermedia contracts and input validation, preventing intercepted mobile or Angular REST calls from tampering with links or form fields. A live demo shows proxy-manipulated account changes and SQL injection payloads blocked. HDIV applies integrity checks to links and validates 90–95% of read-only fields, combines with AS tools to reduces reported issues from 1,000 to ~20, and proposes HAL-forms support in Spring to deliver dynamic form metadata and runtime enforcement.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:29About me
- 5:13The old new things
- 6:06How big is the problem
- 6:55Security issues
- 8:52Design Flows
- 11:03Security solutions
- 15:43The solution for
- 29:55Form support Pull Request
- 32:50Form Support in Action
- 43:17Summary
related talks
21mBuilding Flexible APIs with Spring HATEOAS
47mHypermedia IRL
42mREST is for Agents: Rediscovering Spring HATEOAS
01h 31mSpring Data REST - Data Meets Hypermedia + Security
01h 31mCreating REST-ful, Hypermedia-based Micro-services with Spring Boot
01h 35mSpring Data REST - Data Meets Hypermedia
49mFrom CRUD to Hypermedia APIs with Spring (RU)
41mWhy 99% of Companies Building REST APIs Lie?