David Chandler
JSF evangelist and Senior Engineer with Intuit
Internet banking industry. An electrical engineer by trade, David got
hooked on developing dynamic Web applications in the days of NCSA
Mosaic and hasn't looked back since. He has written Web applications
professionally in a variety of languages, including C, perl, ksh,
ColdFusion, Java, and a domain-specific language built with lex and
yacc. He has tried to forget everything except JSF. David has
presented at ApacheCon and OWASP conferences as well as local user
groups, and is the author of one of the first books on Web
development, Running a Perfect Web Site (Que, 1995).
David holds a Bachelor of Science degree in Electrical Engineering
from the University of Kansas and a patent on a method of organizing
hierachical data in a relational database. He lives in Atlanta with
the wife of his youth and helps homeschool their five children. In his
copious spare time, David teaches classes through learnjsf.com and
works on RememberOneAnother.com, a prayer organizer and church
networking Web site built with JSF, Spring, and Hibernate.
Presentations
Securing JSF applications against the OWASP top ten
In this section, we explore how JSF protects against these attacks and move on to explore JSF extensions you can deploy to provide complete protection against the OWASP Top Ten, including forced browsing, information leakage in select boxes, and unauthorized method execution.
The JavaServer Faces (JSF) API is an excellent foundation for building secure Web applications because of its component-oriented nature, carefulness surrounding data validation, and numerous extension points. The leading JSF implementations build on this strength by providing components which offer built-in protection against many of the OWASP Top Ten attacks including form parameter tampering and cross-site scripting. Specifically, we?ll look at centralized approaches to ensuring that every field and form is properly validated, a phase listener and view handler to prevent forced browsing and assist with detection of session hijacking, and a customer converter and component to hide sensitive information such as IDs in menu options.
