Secure Authentication and Session Management in Java EE

on YouTube ↗52m

" summary

Java EE does not secure authentication and sessions automatically; live demos exploit session IDs in URLs, network-sniffed cookies and XSS to hijack accounts. Tools shown include TCPdump and Cookie Manager and a tiny servlet that logs stolen cookies; attacks successfully replay sessions and perform CSRF money transfers. Fixes demonstrated are setting tracking mode to cookie, enabling HttpOnly and secure flags, serving static assets separately, and calling changeSessionId (Java EE 7) after login; recommended timeouts: 2–5 minutes for critical apps, 15–30 otherwise.

AI-written summary · about

" chapters (14)

1. 0:00Introduction and speaker background
2. 1:34Security problems and HTTP sessions
3. 7:14Demo: Session hijacking via URL
4. 12:47Demo: Session hijacking via network sniffing
5. 16:55Securing session IDs during transport
6. 21:00Demo: Cross-site scripting attack
7. 26:16Preventing XSS with HTTP-only cookies
8. 28:30Session fixation and ID rotation
9. 31:49Enhancing session security with fingerprints
10. 33:17Java EE authentication methods
11. 35:08Demo: Cross-site request forgery
12. 39:54Preventing CSRF with unique tokens
13. 41:25Escaping dynamic content in JSP
14. 44:04Conclusion and continuous learning

" related talks

• 52mSecure Authentication and Session Management in Java EEPatrycja Wegrzynowicz · Voxxed Days Bucharest 2016
• 50mSecure Authentication and Session ManagementPatrycja Wegrzynowicz · JavaDay Kyiv 2015
• 42mSession Security in Web ApplicationsKateryna Ovechenko · QA Fest 2014
• 31mHow to Protect Yourself Against XSS Attacks in JavaPiotr Bucki · JDD 2012
• 54mWhat's New in Java EE Security: JSR-375 and BeyondWill Hopkins · Devoxx US 2017
• 38mIdentity and Access Management in the 21st CenturyGerke Kok · J-Fall 2015
• 42mWhat's New in Java EE 8: the Java EE Security APIRudy De Busscher · Oredev 2017
• 56mHow to avoid vulnerabilities and adopt security best practices?Tomasz Janczewski · Confitura 2025