2 replies to this topic

[common_man]

Hi Friends,

I am developing a web application in Java/JSP/Servlets with Oracle as back-end. I need to know what all security measures can be provided/implemented for this application. Pointers/Links for any helpful sites will be great :)

[Alexander]

Your main concern, if you've a standard servlet container that has been set up correctly is to verify all user input and actions. You must look at every single little thing that the user sends, or enacts in your application and ensure they cannot do more than they "should". This could be access control, resource usage, database calls (always ensure speaking with the database is properly sanatized from malicious injection and alike.)

Your question is fairly broad.

[haltox]

On the oracle database you should set roles to modify important tables and then define plsql procedures to do so. This way, you could call the procedures with the "lower" applicative role and you get an extra layer of protection.