Tomcat DOS attack vulnerability

Tomcat by default supports multipart mime types.  For this purpose it uses apache commons fileupload library. However when there is a request longer then approximately 4 kb, tomcat goes to an endless loop which finally causes a high usage of cpu resources. This vulnerability is present in tomcat 7 and 8 versions only and there are patches that can be applied manually.

http://www.javacodegeeks.com/2014/02/apache-tomcat-and-denial-of-service-vulnerability.html

What is declarative security?

Declarative security is the means of securing an application by means of deployment descriptors.
In ejb world it could be in ejb-jar.xml which is in META-INF folder. In web applications it could be in web.xml file in WEB-INF folder.

Why bcript and not md5,sha1 etc...1?

Well the answer is well written in the following page. The link is given below

http://codahale.com/how-to-safely-store-a-password/

showing and hiding elements based on the user role in spring security

In the previous blog post I showed you how to  provide method level security.  Now let's see how to hide or show elements based on the user role. Well it is quite simple with spring security tag library. just do the following to grant rights to view a specific user role to access some content.

declare the tag lib as follows in the jsp file

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

* Note that in order to use the above library you need to add the spring security tag lib jar file in your class path. you can easily get the dependency from maven repository.

Then go to the element you need to grant rights and surround it with the following block.
<sec:authorize access="hasRole('supervisor')">
</sec:authorize>

Also do not forget to put the following line to your spring security context file.
<beans:bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>

Providing method level security

I showed you how to provide basic security in spring mvc with intercept url patterns in here. Now with that knowledge let's see how to provide method level security.

This can be achieved by using @Preauthorize annotation. First you need to enable it. For that you need to add the following line to your dispatcher servlet.


<global-method-security
pre-post-annotations="enabled" />

Then you can use @Preauthorize annotation.
eg : @PreAuthorize("isAuthenticated() and hasRole('ROLE_ADMIN')")

In the above example the method is allowed to execute if the user is authenticated and has the ROLE_ADMIN role.

How ever you can use @Secure annotation as well. For that you need to add the following line to your dispatcher servlet.

<global-method-security secured-annotations="enabled" />

How ever the first method gives you more flexibility to handle the permissions as it is based on expressions.