The end. Carl Nettelblad 2015-06-04



Similar documents
JVA-122. Secure Java Web Development

Java EE 7: Back-End Server Application Development

Module 13 Implementing Java EE Web Services with JAX-WS

ITS. Java WebService. ITS Data-Solutions Pvt Ltd BENEFITS OF ATTENDANCE:

Developing Java Web Services

Complete Java Web Development

Check list for web developers

WEB SERVICES. Revised 9/29/2015

JAVA ENTERPRISE IN A NUTSHELL. Jim Farley and William Crawford. O'REILLY 4 Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo.

Case Studies of Running the Platform. NetBeans UML Servlet JSP GlassFish EJB

Java EE Introduction, Content. Component Architecture: Why and How Java EE: Enterprise Java

Course Description. Course Audience. Course Outline. Course Page - Page 1 of 5

Java Web Services Training

JVA-561. Developing SOAP Web Services in Java

Course Name: Course in JSP Course Code: P5

JBoss SOAP Web Services User Guide. Version: M5

Reusing Existing * Java EE Applications from Oracle SOA Suite

WebSphere Server Administration Course

IBM WebSphere Server Administration

Building Web Applications, Servlets, JSP and JDBC

Building and Using Web Services With JDeveloper 11g

OpenShift is FanPaaStic For Java EE. By Shekhar Gulati Promo Code JUDCON.IN

Oracle EXAM - 1Z Java EE 6 Web Services Developer Certified Expert Exam. Buy Full Product.

Workshop for WebLogic introduces new tools in support of Java EE 5.0 standards. The support for Java EE5 includes the following technologies:

Virtual Credit Card Processing System

Developing XML Solutions with JavaServer Pages Technology

Criteria for web application security check. Version

<Insert Picture Here> Java EE 7. Linda DeMichiel Java EE Platform Lead

The Java EE 6 Platform. Alexis Moussine-Pouchkine GlassFish Team

FUSE-ESB4 An open-source OSGi based platform for EAI and SOA

Project 2: Web Security Pitfalls

}w!"#$%&'()+,-./012345<ya

ArcGIS Server Security Threats & Best Practices David Cordes Michael Young

Magento Security and Vulnerabilities. Roman Stepanov

Nicholas S. Williams. wrox. A Wiley Brand

XML Processing and Web Services. Chapter 17

70-487: Developing Windows Azure and Web Services

APAC WebLogic Suite Workshop Oracle Parcel Service Overview. Jeffrey West Application Grid Product Management

Top Ten Web Application Vulnerabilities in J2EE. Vincent Partington and Eelco Klaver Xebia


Copyright 2013 Consona Corporation. All rights reserved

Security Code Review- Identifying Web Vulnerabilities

Client-Server Architecture & J2EE Platform Technologies Overview Ahmed K. Ezzat

Lesson 4 Web Service Interface Definition (Part I)

An introduction to creating JSF applications in Rational Application Developer Version 8.0

Course Number: IAC-SOFT-WDAD Web Design and Application Development

Still Aren't Doing. Frank Kim

JAVA r VOLUME II-ADVANCED FEATURES. e^i v it;

IT6503 WEB PROGRAMMING. Unit-I

White Paper: Why Upgrade from WebSphere Application Server (WAS) v7 to v8.x?

Developing a Web Server Platform with SAPI Support for AJAX RPC using JSON

Operation, Monitoring, and Linkage Guide

ICE Trade Vault. Public User & Technology Guide June 6, 2014

Java 7 Recipes. Freddy Guime. vk» (,\['«** g!p#« Carl Dea. Josh Juneau. John O'Conner

Apache Sling A REST-based Web Application Framework Carsten Ziegeler cziegeler@apache.org ApacheCon NA 2014

What is Web Security? Motivation

Specialized Programme on Web Application Development using Open Source Tools

White Paper BMC Remedy Action Request System Security

Web Application Security Considerations

Java EE Web Development Course Program

Web Service Development Using CXF. - Praveen Kumar Jayaram

SoapUI NG Pro and Ready! API Platform Two-Day Training Course Syllabus

Columbia University Web Security Standards and Practices. Objective and Scope

Developing Web Services with Eclipse

Install guide for Websphere 7.0

: Test 217, WebSphere Commerce V6.0. Application Development

CrownPeak Java Web Hosting. Version 0.20

Distribution and Integration Technologies

Accessing Data with ADOBE FLEX 4.6

<Insert Picture Here> GlassFish v3 - A Taste of a Next Generation Application Server

Deploying Microsoft Operations Manager with the BIG-IP system and icontrol

Enterprise JavaBeans 3.1

Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications

A Comparison of Service-oriented, Resource-oriented, and Object-oriented Architecture Styles

JBoss JEE5 with EJB3.0 on NonStop. JAVA SIG, San Jose

Java EE 6 Ce qui vous attends

Why IBM WebSphere Application Server V8.0?

Java Platform, Enterprise Edition (Java EE) From Yes-M Systems LLC Length: Approx 3 weeks/30 hours Audience: Students with experience in Java SE

How To Create A C++ Web Service

General principles and architecture of Adlib and Adlib API. Petra Otten Manager Customer Support

Application Design and Development

JAX-WS Developer's Guide

Building Java Servlets with Oracle JDeveloper

SAP Web Application Server 6.30: Learning Map for Development Consultants

Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines

REDCap General Security Overview

Creating Web Services Applications with IntelliJ IDEA

Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security

Web Development with the Eclipse Platform

Stock Trader System. Architecture Description

StreamServe Persuasion SP5 StreamStudio

Spring Security 3. rpafktl Pen source. intruders with this easy to follow practical guide. Secure your web applications against malicious

Application Security Policy

Japan Communication India Skill Development Center

Enterprise Application Security Workshop Series

NetBeans IDE Field Guide

Transcription:

The end Carl Nettelblad 2015-06-04

The exam and end of the course Don t forget the course evaluation! Closing tomorrow, Friday Project upload deadline tonight Book presentation appointments with Kalyan

The exam Correction has started Easy to score some points Hard to nail everything Frequently specific questions posed in the exam text that are simply not answered

Question 1. The Java Architecture for XML Binding (JAXB) and the Java Persistence API (JPA) are two components in JavaEE. They are both used for interacting with other technologies outside of Java. Discuss the similarities between these components, their respective use (including which other JavaEE components rely on them), and how you can maintain a specified contract or schema against a non-java user in the two cases. Also discuss what other components there are in JavaEE for interacting with the same external technologies, and compare them. (6p)

Answer 1 Java Persistence API database tables modelled as Java classes Java Architecture for XML Binding XML elements modelled as Java classes Note the similarity? JAX-WS and JAX-RS rely on JAXB JDBC is another option for database access (slightly more low-level, JPA implementations in fact tend to use JDBC) Expected answer for other XML APIs: DOM, SAX, StAX A lot of you mentioned XSLT, that s relevant, but a bit off the point Both JPA and JAXB support Generate classes from existing schema (database structure or XSD file) Generate schema (SQL statements or XSD file) from annotated classes

Question 2 a) DocumentationConfiguration in JavaEE can frequently be stored in XML files, as well as in annotations. What is an annotation? Why would one choose one over the other in a JavaEE application? (2p) b) We have also used annotations to define injection of specific resources. What is resource injection? Why would one choose to use resource injection over having something like the following in a program? (1p) @Stateless public class DemoEjb implements DemoLocal { private DataSource ds = null; @PostConstruct public void initmethod() { } ctx = new InitialContext(); ds = (DataSource)ctx.lookup("jdbc/fastCoffeeDB"); } //...

Answer 2 Sorry about messup documentation/configuration. Not an obvious effect on most answers Most answers look like you read Configuration A good answer assuming that it really should read Documentation will be respected

Answer 2 Annotations are specific additional meta-data added in a type-safe way to language elements (classes, methods, arguments, variables) Parsed and stored by the compiler Inspected at runtime (here: by the Java container) @ sign A really short description is OK, mentioning @ sign or some example is almost required for full score, unless the theoretical description is very thorough

Where to put configuration? Do you expect it to change? I.e. dependent on specific container/server environment Is it used by many classes? Put in XML! Is it very specifically tied to the workings of the code Put as Java annotations

Resource injection The code example is also an example of using a containermanaged resource Therefore, many answers relating to connection pools, why the container should manage resources etc are correct, but somewhat off the point The core aspect here is what we want to focus on in our code Resource injection is a compact declarative way to request a container-managed resource, allowing the container to manage dependencies. A single line showing the intent. The actual intent of retrieving the resource is less clear in the example code in the exam.

Question 3 In the servlet API, a servlet has to be reentrant. What does this mean, and what are the consequences? In the EJB API, it is stated that the bean classes do not have to be reentrant. How is concurrent access handled instead? Also, in this context, describe the difference between a stateless and a stateful session EJB. (4p)

Reentrant servlets Servlets are reentrant The same instance is used to serve all requests A method can be called to service a new request, on a new thread, while another request is being processed What does this mean? Instance variables and other data are shared, unless you use other means to store them

Non-reentrant EJBs EJBs are not reentrant (Unless you go some length to explicitly ask it to be) Instead, many instances are created These can be shared in pools, but only a single client (object using the EJB) is using a specific instance at any single time Only a single method call going on For stateless EJBs, the ownership by the client starts and ends with every single method call For stateful EJBs, the same instance is locked to a specific client from the time it is retrieved until it goes out of context

Question 4 What is a web service? Web services are designed to be independent of language, technology vendor, and platform. How is this achieved? What is the difference between SOAP-based and RESTful web services? How are web services handled in JavaEE? (4p)

Answer 4 Web services Providing programmatic access to data and services in our application Other code talking to our code over the Internet SOAP General way to send synchronous messages Basically stateless method calls HTTP is one of many transport Typically XML-formatting of messages, rather verbose syntax Multiple services provided in one endpoint (URL)

Answer 4 SOAP Interface of endpoint defined by WSDL REST Using the basic verbs of HTTP The URL represents the request (combined with the request content) Different objects have different URLs Frequently JSON or XML data Just representing the object itself No really general schema definition, self-explaining instead

Answer 4 JAX-WS and JAX-RS are used to interact with and provide web services in JavaEE

Question 5 The model-view-controller paradigm is a common way to design and look at web applications. Using JSP, servlets and (possible Enterprise Java) beans, what is the role of each component in this paradigm? What kind of code/logic would you ideally want to have on each level? How could you use JSF instead?

Answer 5 Model view controller Crucial architectural concept in the course! Model the world and what can happen in the world Implemented as beans Not only containing data, also the actions we can take on data Create objects, modify objects, delete objects in different ways

Answer 5 View Present actual HTML pages to the user In JSP, try to use very little scriptlets, stick to EL and JSTL Present the information stored in the beans served by the controller

Controller Servlet Parsing requests Calling model Populating state from the model into contexts Directing rendering to the correct view Rules of thumb Keep actions that modify data out of views Keep external resource out of controller Keep explicit HTML out of model, ideally out of controller as well

JSF instead JSF is a general modularized framework for multiple HTTP request/response interactions within the same view The controller is managed by the JSF servlet View actions can map directly to bean action methods Control flow also defined by navigation rules

Question 6 a) A web application developer can easily create SQL injection and cross-site scripting problems. Describe what these are and how you can avoid them. Why would the JSTL tag c:out be relevant in this? (2p) b) We talk about programmatic versus declarative security. What do we mean by this, and how can the container help us in maintaining authentication and authorization? Why should the full session, not only the login process, be encrypted - even if the information itself is not sensitive? (4p)

Answer 6 SQL injection adding (unverified) data into a SQL command Can result into data being parsed as SQL code, by data including apostrophes etc Can result in data loss, data being exposed, data being modified, exploits of other parts of the system Avoided by Prepared statements/parametrized queries (or stored procedures, if those are called in a safe manner!) Escaping any dangerous characters or character combinations (not preferable)

Cross-site scripting (XSS) Input from user or another website being run as a script or intepreted as HTML in the context of your web-site Example scenario Result Unvalidated comment form on a news post Arbitrary code/script being run in the context of the users web browser Can access cookie, can redraw the web page to give the impression of the user doing something else than what is really happening Only client-side, but If the exploit affects an admin user, your whole application can be threatened

Cross-site scripting Avoid it by Validating all input Escaping output c:out tag has a default setting of escaping being active, i.e. string <script> would be rendered as <script>script

Declarative security You specify what pages to protect The container maintains specific roles Programmatic and declarative security Even EJB methods can be protected based on such roles Form-based and other methods Programmative security The developer maintains security Checks if the user identity is appropriate for a specific action However, you can ask the container to authenticate programmatically In short: you can use container-based authentication even if you have programmatic authorization

As in many other cases in the course Programmative and declarative security If a declarative approach matches what you want to do, it is probably the safer and more clear way to do it Less things that can go wrong (in your code) Relying more on the code already written and tested by others More clear to a future person who is going to implement changes

All-https Why would we want to encrypt login? To protect user name and password Can be done with hashes over a clear channel (digest-style authentication) Why would we want to stay logged in? The user gets a cookie for identifying the session Every single request contains that cookie Gaining access to the user s account is just a matter of capturing that cookie over an unencrypted session

Project demonstrations If you demonstrate now, no requirement to demonstrate in person later

Your questions? Related to The exam The project Don t forget the course evaluation!