TY - GEN
T1 - Coding Practices and Recommendations of Spring Security for Enterprise Applications
AU - Islam, Mazharul
AU - Rahaman, Sazzadur
AU - Meng, Na
AU - Hassanshahi, Behnaz
AU - Krishnan, Padmanabhan
AU - Yao, Danfeng Daphne
N1 - Publisher Copyright:
© 2020 IEEE.
PY - 2020/9
Y1 - 2020/9
N2 - Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguration vulnerabilities in the light of Spring security, which is relatively understudied in the existing literature. Towards that goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable defaults by conducting a measurement-based approach on 28 Spring applications. Our analysis shows that security risks associated with the identified security anti-patterns and insecure defaults can leave the enterprise application vulnerable to a wide range of high-risk attacks. To prevent these high-risk attacks, we also provide recommendations for practitioners. Consequently, our study has contributed one update to the official Spring security documentation while other security issues identified in this study are being considered for future major releases by Spring security community.
AB - Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguration vulnerabilities in the light of Spring security, which is relatively understudied in the existing literature. Towards that goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable defaults by conducting a measurement-based approach on 28 Spring applications. Our analysis shows that security risks associated with the identified security anti-patterns and insecure defaults can leave the enterprise application vulnerable to a wide range of high-risk attacks. To prevent these high-risk attacks, we also provide recommendations for practitioners. Consequently, our study has contributed one update to the official Spring security documentation while other security issues identified in this study are being considered for future major releases by Spring security community.
KW - Spring security
KW - insecure coding practices
KW - security anti patterns
UR - http://www.scopus.com/inward/record.url?scp=85096646142&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85096646142&partnerID=8YFLogxK
U2 - 10.1109/SecDev45635.2020.00024
DO - 10.1109/SecDev45635.2020.00024
M3 - Conference contribution
AN - SCOPUS:85096646142
T3 - Proceedings - 2020 IEEE Secure Development, SecDev 2020
SP - 49
EP - 57
BT - Proceedings - 2020 IEEE Secure Development, SecDev 2020
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2020 IEEE Secure Development, SecDev 2020
Y2 - 28 September 2020 through 30 September 2020
ER -