Security is one of the most important aspects of almost all web applications.  There are many areas of concern like client and server machine security, transmission channel security, database security etc.

While most security concerns are the responsibility of server or network administrators, application developers should also be concerned about some of the aspects of security such as authentication, authorization, data integrity and confidentiality.

1. Authentication

   • is the process of verifying if the user, usually with a username and password.

   • Once authenticated, we may call a user as an authenticated user or a logged in user.

2. Authorization

   • is the process of checking if a user is allowed to access a particular resource on the server.

3. Data integrity

   • is the process of verifying if data is transmitted without corruption or modification, thus making sure that the data received at the receiver end is in fact the same message sent by the sender.

4. Confidentiality

   • is the process of maintaining data privacy wherein we secure the communications channel, to make sure the data is not accessed in its original form by a third party by eavesdropping.

Authentication in Java EE Applications

Java EE provides four different ways to authenticate a user:

1. Basic Authentication

2. Digest Authentication

3. Form Authentication

4. SSL Certificates

Data used to authenticate a user are called credentials; while the first three rely on username and password provided by user, the fourth one relies on encryption techniques and certificates.

Authorization in Java EE Applications

Authorization may be done in different ways, including:

1. Programmatically controlling access to resources based on individual user’s credentials.

2. Assigning users into different groups called roles and assigning permissions based on the roles

Steps for role based authorization can be summarized as:

1. Define roles, users and create mapping between them

2. Define resource collections to which security should be applied

3. Map roles with security constraints

Data integrity and Confidentiality in Java EE web applications

Confidentiality and data integrity are related to securing the communications channel.

We can declaratively specify what level of channel security you need: NONE, INTEGRAL or CONFIDENTIAL (implies INTEGRAL).

Specifying security requirements in Java EE applications

Java EE allows us to define these security requirements, mainly in three ways:

1. We can declaratively declare security requirements for an individual or set of resources through the deployment descriptor (web.xml)

2. We can declare security requirements for individual components through the use of annotations.

3. We can program security requirements using Java code rather than relying on containers declarative security model.

We will see all these in detail in further notes in this notebook.