liveBookmanning.com

What you will learn in Software Security for Developers

With examples in Java and Spring

by Adib Saikali, Laurențiu Spilcă

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• public keyA public key is the openly distributable member of a cryptographic key pair used for operations such as encryption or signature verification.
• API keyAn API key is a credential, usually represented as a secret token, that identifies or authorizes a client calling an application programming interface.
• public-private key pairA public-private key pair is a mathematically related pair of asymmetric cryptographic keys in which the private key signs data and the public key verifies it.
• openid connectOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile information.
• private keyA private key is the confidential member of a cryptographic key pair used for operations such as decryption or digital signing.
• TLSTLS is a cryptographic protocol standard that provides confidentiality, integrity, and authenticated communication over networks.
• role-based access controlRole-based access control is an access-control technique that grants permissions through roles, with role definitions potentially isolated for different organizational contexts.
• authenticationMessage authentication is the process by which a recipient verifies the identity of the party that sent a message.
• WebAuthnWebAuthn is a web authentication standard that enables passwordless, phishing-resistant authentication through authenticators such as biometrics and physical security keys.
• digital signatureA digital signature is a cryptographic value that authenticates a message and binds it to the signer so that the signature can be independently verified.
• attribute-based access controlAn attribute-based access rule is a condition that grants or denies access by comparing relevant subject, resource, or environmental attributes.
• Galois/Counter ModeAES-GCM is an authenticated-encryption mode of AES that provides confidentiality and message integrity with associated data support.
• passwordless authenticationPasswordless authentication is an authentication approach that verifies a user without requiring a conventional password.
• RSARSA is a public-key cryptographic algorithm based on the computational difficulty of factoring large integers.
• certification authorityA local certificate authority is a privately operated certificate authority that issues certificates within an organization's or development environment's trust boundary.
• single sign-onA single sign-on service centralizes user authentication and enables authenticated users to access multiple applications without separately authenticating to each one.
• relationship-based access controlRelationship-based access control, or ReBAC, is an access-control technique that makes authorization decisions from relationships among entities such as users, resources, groups, and projects.
• cryptographic hashA cryptographic hash function maps input data to a fixed-size digest designed to detect changes while resisting reversal and collision generation.
• public key cryptographyA public-key cryptosystem is a cryptographic system that uses mathematically related public and private keys for security operations.
• cryptographic keyA secret key is confidential cryptographic material shared by authorized parties to compute or verify keyed security values.
• encryptionEncryption is the transformation of readable data into an encoded form intended to prevent unauthorized access.
• HMACHMAC is a keyed message authentication construction that combines a secret key with a cryptographic hash function to provide message integrity and authenticity.
• elliptic-curve cryptographyElliptic-curve cryptography is public-key cryptography based on the algebraic structure of elliptic curves over finite fields.
• message authentication codeA message authentication code is a keyed value that enables verification of a message's integrity and origin.
• biometricsBiometric data is information representing measurable physical or behavioral characteristics of a person for identification or authentication.
• tokenA token is a security artifact carrying authorization or identity information between participants in an authentication or authorization protocol.
• signature verificationSignature verification is the cryptographic process of checking a digital signature against its message and corresponding public key.
• JSON Web SignatureJSON Web Signature is a JOSE standard for representing digitally signed or MAC-protected content in JSON-based form.
• SHA-256SHA-256 is a member of the SHA-2 family of cryptographic hash algorithms that produces a 256-bit digest.
• authorization code flowThe authorization code flow is an OAuth flow in which a client obtains an authorization code through user authorization and exchanges it for an access token.
• initialization vectorAn initialization vector is a non-secret value combined with encryption input to vary the cryptographic transformation, such as the per-encryption value required by AES-GCM.
• relationship storeA central relationship store is a shared repository that records relationships used to evaluate relationship-based access decisions.
• service identityService identity is the identity of a service that makes a request on behalf of a user or another initiating entity.
• OAuthOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
• data integrityIntegrity is the property that data or a message remains accurate and unaltered during transmission or storage.
• security keyA security key is a physical authentication device that proves possession of a cryptographic credential during login.
• magic linkMagic link authentication verifies a user's identity through a login link delivered to a previously associated email address instead of a memorized password.
• Proof Key for Code ExchangeProof Key for Code Exchange is an OAuth extension in which a client proves possession of a per-request secret when exchanging an authorization code.
• certificate signing requestA certificate signing request is a signed request containing a subject's identifying information and public key that is submitted to a certificate authority for certificate issuance.
• OpenID Connect ID tokenAn ID token is an OpenID Connect JWT containing claims about the authenticated end user and the authentication event.
• JSON Web EncryptionJSON Web Encryption is a JOSE standard for representing encrypted content in JSON-based form.
• authentication challengeAn authentication challenge is a fresh, unpredictable value supplied during an authentication ceremony to bind the response to that specific ceremony and demonstrate possession of a credential.
• resource serverA resource server is an application backend that hosts protected data and enforces authorization for requests bearing access tokens.
• credential storeA credential service is a centralized system that securely stores, manages, distributes, rotates, and audits application credentials.
• mutual TLSMutual TLS is a TLS configuration in which both communicating parties authenticate each other with digital certificates.
• identity providerAn identity provider is a system that authenticates identities and provides identity information to relying applications or services.
• replay attackA replay attack is an attack in which a valid previously captured message or credential is retransmitted to obtain an unauthorized effect.
• secure contextA secure context is a web execution environment that meets browser security requirements for exposing protected web platform features.
• credentialA client credential is authentication material that identifies an OAuth client to an authorization server.
• authentication flowAn authentication flow is a prescribed sequence of interactions through which an application or service verifies an entity's identity.
• identityUser identity is the identity of the human or system entity that initiates a request chain.
• certificate chainA certificate chain is an ordered sequence of an end-entity certificate and the certificates of the intermediate and root authorities that establish its trust.
• credential IDA credential ID is the identifier that distinguishes a WebAuthn public key credential for authenticator selection and verification.
• WebAuthn registrationWebAuthn registration is the ceremony in which an authenticator creates a public key credential and the relying party stores its credential data.
• SHA-3SHA-3 is a family of cryptographic hash algorithms standardized with multiple output sizes including 224, 256, 384, and 512 bits.
• email enumeration attackAn email enumeration attack determines whether particular email addresses correspond to registered accounts by observing application responses.
• key-distribution problemKey distribution is the process of delivering cryptographic keys to authorized parties while preventing unauthorized access.
• service-oriented authorizationService-oriented authorization is an authorization approach in which independently deployed services make authorization decisions for requests they receive.
• service meshA service mesh is an infrastructure layer that manages communication between distributed services, commonly providing traffic control, observability, and security.
• root certificateA root certificate authority is a self-signed certificate authority whose trust anchor is typically preinstalled in an operating system or other trust store.
• platform authenticatorA platform authenticator is an authenticator integrated into a computing device or operating system that performs WebAuthn credential operations.
• public key credentialA public key credential is a WebAuthn credential containing a credential identifier and public key that an authenticator uses for identity verification.
• relying party IDA relying party ID is the domain identifier that binds a WebAuthn credential and authentication ceremony to the intended service.
• SHA-2SHA-2 is a family of standardized cryptographic hash functions that includes SHA-224, SHA-256, SHA-384, and SHA-512.
• rsa-oaepOAEP is a randomized RSA encryption padding scheme that uses hash-based encoding to reduce structural leakage and strengthen security against attacks on ciphertexts.
• refresh tokenA refresh token is a credential that a client presents to an authorization server to obtain a new access token without repeating the user authorization interaction.
• ciphertextCiphertext is data produced by encryption that is intended to be unintelligible without the required cryptographic key.
• infrastructure-level authorizationInfrastructure-level authorization is authorization enforced by shared infrastructure outside application service logic, typically through gateways or service meshes.
• JSON Web TokenJSON Web Token is a compact, URL-safe format for representing claims that can be transmitted between parties.
• one-time codeA one-time password is an authentication code that is valid for a single use or a limited period.
• block cipherA block cipher is an encryption algorithm that divides data into fixed-size blocks and transforms each block using a secret key.
• biometric templateA biometric template is a stored digital representation of biometric characteristics used for comparison during biometric recognition or authentication.
• multifactor authenticationMultifactor authentication verifies identity using two or more independent authentication factors.
• intermediate certificateAn intermediate certificate authority is a certificate authority certified by another authority and used to issue certificates below a root authority in a trust hierarchy.
• mode of operationA mode of operation defines how a block cipher processes messages longer than a single block and may provide additional security properties.
• client credentials grant typeThe client credentials flow is an OAuth flow in which a client authenticates with its own credentials to obtain an access token without an end-user authorization step.
• Spring SecuritySpring Security is a Java and Spring framework for authentication, authorization, and protection against common application security threats.
• presentation attackA presentation attack attempts to fool a biometric sensor by presenting an artificial or reproduced biometric artifact such as a photo, video, or fingerprint mold.
• elliptic curveAn elliptic curve is an algebraic curve defined by a cubic equation that supports cryptographic constructions.
• paddingPadding is the addition of extra data so that an input conforms to a required fixed block size or cryptographic encoding format.
• roleA role is a named collection of permissions or access responsibilities assigned to a subject in an access-control system.
• key sizeKey size is the number of bits in a cryptographic key and determines the size of the key space available to an algorithm.
• cipher block chaining modeAES-CBC mode is a block-cipher operating mode that chains plaintext blocks through AES encryption using an initialization vector.
• public clientA public client is an OAuth client that cannot keep client credentials confidential, such as a client distributed to users or running in a browser.
• authenticated encryption with associated dataAuthenticated encryption with associated data is an encryption technique that simultaneously protects ciphertext confidentiality and authenticates both ciphertext and associated plaintext data.
• revocationToken revocation is the invalidation of a security token before or at the end of its normal validity period.
• code challengeA code challenge is a value derived from a PKCE code verifier and sent to an authorization server to bind an authorization session to that verifier.
• Java Cryptography ArchitectureThe Java Cryptography Architecture is Java's standard framework of interfaces, classes, and algorithm services for cryptographic operations.
• Java Cryptography ExtensionsThe Java Cryptography Extensions are Java APIs and implementations that extend cryptographic support beyond the core Java Cryptography Architecture.
• code verifierA code verifier is a client-generated, unpredictable secret value presented when exchanging an authorization code in a PKCE flow.
• role explosionRole explosion is the growth of numerous overly specific roles that makes role management, naming, auditing, and access analysis difficult.
• Bouncy CastleBouncy Castle is a cryptographic software library that provides Java Cryptography Extension providers and implementations of many cryptographic algorithms.
• certificate subjectA certificate subject is the certificate field identifying the entity that owns or is associated with the public key.
• confidentialityConfidentiality is the security property that information is accessible only to authorized parties.
• subject alternative nameA subject alternative name is an X.509 certificate extension that associates a subject with identifiers such as DNS names, email addresses, IP addresses, or URIs.
• JSON Web AlgorithmsJWA is an IETF registry standard that assigns interoperable names and identifiers to cryptographic algorithms used with JOSE.
• cryptographyCryptography is the study and practice of securing information and communications through mathematical techniques such as encryption and digital signatures.
• Spring Authorization ServerSpring Authorization Server is a Spring framework project for building OAuth 2.0 and OpenID Connect authorization servers.
• modularityA modular monolith is a single application organized into well-defined independent modules that communicate through clean interfaces and own specific domains or features.
• phishingA phishing attack is a social-engineering attack that impersonates a trusted party to trick a person into disclosing information or performing an unauthorized action.
• nonrepudiationNonrepudiation is the legal and technical property that provides proof that a specific action or message was performed or sent by a specific party.
• trust anchorA trust anchor is a pretrusted cryptographic key or certificate authority used as the starting point for validating a chain of trust.
• zero-trust networkingThe zero-trust principle is a security approach that requires continuous verification and grants no implicit trust based on network location or prior access.
• palm-vein scanningPalm-vein recognition is biometric authentication that identifies a person from the vein patterns inside the palm, typically captured with infrared sensors.
• certificate validationCertificate validation is the process of determining whether a certificate's signatures, validity dates, issuing authority, and trust chain satisfy applicable requirements.
• DNS-01 challengeA DNS challenge is a domain-control verification method that requires publishing specified data in the domain's DNS records.
• HTTP-01 challengeAn HTTP challenge is a domain-control verification method that requires placing a specified file or response at an HTTP-accessible location.
• hybrid encryptionHybrid encryption is a scheme that uses public-key cryptography to protect a symmetric encryption key and symmetric cryptography to protect the data.
• ingress controllerAn ingress controller is software that implements Kubernetes ingress routing and commonly handles TLS termination, load balancing, and path-based routing.
• tenantA tenant is an independently scoped organization or customer population sharing an identity system while retaining separate users, configuration, and access boundaries.
• data corruptionData corruption is unintended alteration or loss of stored or transmitted data that makes it differ from its correct contents.
• vulnerabilityA weakness in software that can be exploited to compromise confidentiality, integrity, or availability.
• biometric enrollmentBiometric enrollment is the process of registering a person's biometric characteristics and creating a reference representation for later authentication.
• rsaes-pkcs1-v1_5RSAES-PKCS1-v1_5 is an RSA encryption scheme that encodes messages using the PKCS #1 version 1.5 encryption encoding method.
• KubernetesA Kubernetes cluster is a set of coordinated machines that provides the control plane and execution resources for Kubernetes workloads.
• liveness detectionLiveness detection determines whether biometric input comes from a living person rather than a replica or recorded presentation.
• trusted execution environmentA trusted execution environment is an isolated hardware- or software-protected area that executes sensitive operations and protects data from the main operating environment.
• key wrappingKey wrapping is the encryption of one cryptographic key with another key for secure transport or storage.
• alg:none vulnerabilityalg:none is a JWS algorithm identifier indicating that no digital signature or message authentication code is applied.
• origin bindingDomain binding is an authentication control that associates a credential or authentication operation with a specific web origin or domain.
• self-signed certificateA self-signed certificate is a certificate whose signature is created using the private key corresponding to its own public key rather than a separate certificate authority's key.
• custom authorization logicCustom authorization logic is application-defined code that verifies service requests and determines whether they should be accepted.
• signature algorithmA signature algorithm is a cryptographic algorithm that generates or verifies digital signatures.
• TLS terminationTLS termination is the process of decrypting and handling a TLS connection at an endpoint before forwarding the resulting traffic.
• attributeAn attribute is a piece of information describing a user, resource, or environmental context that can be evaluated in an access-control rule.
• issuerAn issuer field is the X.509 certificate field that identifies the certificate authority or entity that issued the certificate.
• validity periodA certificate validity period is the interval between the times an X.509 certificate becomes valid and ceases to be valid.
• password authenticationA password is a secret character sequence used to authenticate a user or control access to an account or service.
• token introspectionToken introspection is a validation process in which a service queries an issuer or authorization server to obtain the status and metadata of a token.
• cryptographically secure random number generatorA cryptographically secure random number generator produces values that are computationally unpredictable and suitable for cryptographic keys and initialization vectors.
• ACMEACME is an internet protocol for automating certificate issuance and certificate authority domain-control validation.
• Google TinkGoogle Tink is a multi-language cryptographic library that provides safer, simpler APIs for common cryptographic operations.
• symmetric key encryptionSymmetric key cryptography uses the same secret key, or closely related shared keys, to protect and recover data.
• jws payloadA JWS payload is the content carried by a JSON Web Signature, represented as an arbitrary string such as JSON data.
• JOSEJOSE is a family of standards for representing, signing, encrypting, and securing data using JSON-based structures.
• authorization endpointAn authorization endpoint is an identity provider endpoint where a client initiates user authorization and authentication.
• openid configuration endpointAn OpenID configuration endpoint is a standardized endpoint that publishes an identity provider's OpenID Connect metadata and service endpoints.
• token endpointA token endpoint is an OAuth endpoint that accepts an authorization grant and issues access tokens or other tokens.
• monolithic architectureA monolith, or monolithic application, is an application architecture in which the system's components run within one codebase, process, or deployable unit.
• microservice architectureA software architecture that decomposes an application into independently deployable services organized around business capabilities.
• MessageDigest APIThe MessageDigest API is the Java API for obtaining and applying implementations of cryptographic hash functions.
• provider-based architectureA provider-based architecture separates stable application-facing interfaces from replaceable implementations supplied by providers.
• security providerA security provider is a Java component that supplies implementations of cryptographic algorithms and services to the JCA or JCE API.
• SunJCESunJCE is a Java security provider that supplies cryptographic algorithm implementations and is commonly shipped as a default provider with Java distributions.
• elliptic-curve diffie-hellmanElliptic-curve Diffie-Hellman is a Diffie-Hellman key-agreement algorithm based on the discrete-logarithm problem for points on elliptic curves.
• nonceA nonce is a value intended to be used only once within a specified cryptographic or authentication context.
• content encryption keyA content encryption key is a symmetric key used to encrypt the actual protected content in an encryption scheme.
• dynamic client registrationDynamic client registration is an OpenID Connect capability that lets clients register with an identity provider programmatically.
• session isolationIsolated session management is the practice of maintaining authentication sessions separately so activity in one tenant does not affect another tenant's sessions.
• tenant isolationTenant isolation is the separation of each tenant's identity data, configuration, security policies, sessions, and access boundaries from those of other tenants.
• tenant-specific claimA tenant-specific claim is a token or identity assertion that identifies or describes a subject in the context of a particular tenant.
• tenant-specific endpointA tenant-specific endpoint is an identity-service endpoint whose routing and authentication context are associated with one tenant.
• md5MD5 is a legacy cryptographic hash algorithm that produces a 128-bit digest and is considered insecure for modern security applications.
• SHA-1SHA-1 is a legacy cryptographic hash algorithm that produces a 160-bit digest and is considered insecure for modern security applications.
• end entityAn end-entity certificate is a certificate issued to a final subject such as a website, service, organization, or individual rather than to another certificate authority.
• P-256P-256 is a standardized 256-bit prime-field elliptic curve used in public-key cryptography.
• JSON Web KeyJWK is a JSON-based standard for representing cryptographic keys and their associated metadata.
• hmac-sha256HMAC-SHA256 is an HMAC construction that uses SHA-256 to compute the message digest.
• NimbusNimbus is a Java security library for implementing standards-based cryptographic and authentication protocols.
• electronic codebook modeElectronic Codebook mode, or ECB mode, is a block-cipher mode that encrypts each plaintext block independently with the same key.
• scope of identityScope of identity is the degree of specificity with which an identity is assigned to a service, instance, or container.
• openssl x509The openssl x509 command is an OpenSSL command-line utility for reading, inspecting, and manipulating X.509 certificates.
• Diffie–Hellman key exchangeDiffie-Hellman is a public-key key-agreement algorithm based on the computational difficulty of the discrete logarithm problem.
• domain validationDomain validation is a certificate-issuance verification process in which a certificate authority confirms that the requester controls the domain named in a certificate signing request.
• JWE headerJWEHeader is a Nimbus Java class representing the header of a JSON Web Encryption object.
• SPIFFESPIFFE is a standard framework for securely identifying workloads and providing them with verifiable identities.
• identity propagationThe user identity propagation problem is the difficulty of passing the initiating user's identity across services that use different programming languages and communication protocols.
• certificate issuanceCertificate issuance is the process of creating and signing a certificate for an applicant after validating the applicant's request and identity.
• elliptic-curve discrete logarithm problemThe elliptic-curve discrete logarithm problem is the computational problem of determining a scalar from an elliptic-curve point multiplication, believed to be computationally difficult for suitable curves.
• HS256HS256 is a JOSE algorithm identifier for HMAC using the SHA-256 hash function.
• jws headerA JWS header is the JSON object in a JSON Web Signature that identifies the cryptographic algorithm used to protect the object.
• key rotationKey rotation is the replacement of cryptographic keys with new keys according to a planned security lifecycle.
• trust bootstrappingTrust bootstrapping is the process of establishing initial authenticated access between an application and a security service before normal credentials are available.
• UserInfo endpointThe UserInfo endpoint is a standardized OpenID Connect endpoint that returns additional claims and profile information about an authenticated user.
• factorizationInteger factoring is the decomposition of an integer into a product of prime numbers.
• tamperingData tampering is the unauthorized alteration or replacement of data during transmission, storage, or processing.
• man-in-the-middle attackA man-in-the-middle attack is an attack in which an adversary intercepts and potentially alters communication between two parties while impersonating each party to the other.
• PEM formatPEM is a text-based encoding format that represents certificates and other cryptographic objects with Base64 data and delimiter lines.
• subject public key infoSubject Public Key Info is the X.509 certificate structure that contains a subject public key and identifies its key algorithm or type.
• corporate information securityAn organizational security function responsible for securing applications and defining corporate security requirements.
• spoofing attackSpoofing is an attack in which a malicious party presents an imitation of a legitimate identity or signal to deceive an authentication system.
• software supply-chain attackA security attack that compromises software components, providers, or delivery processes to affect downstream applications.
• security libraryA security library is reusable software that provides functionality for application security controls such as authentication, authorization, or cryptography.
• trapdoor functionA mathematical function that is easy to compute in one direction but computationally infeasible to invert without special information.
• hardware security moduleA hardware security module is a specialized tamper-resistant device that protects cryptographic keys and performs security-sensitive cryptographic operations.
• hash collisionA hash collision occurs when two different inputs produce the same hash value.
• collision-resistant hash functionCollision resistance is the computational infeasibility of finding two distinct inputs that produce the same cryptographic hash value.
• one-way propertyThe one-way property is the computational infeasibility of determining an input from a cryptographic hash function's output.
• secure hash algorithmSHA is a family of standardized cryptographic hash algorithms.
• downgrade attackA downgrade attack is an attack that induces a system to use an older or weaker security protocol or algorithm instead of a stronger available option.
• container imageA container image is an immutable package containing an application and the files, metadata, and runtime components needed to execute it in a container.
• Kubernetes manifestA Kubernetes manifest is a declarative configuration document that specifies Kubernetes resources and their desired state.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.