OWASP Top 10 — Web Application Security

We went through an audit by an external penetration tester and the results were instructive. OWASP Top 10 is a minimum, not a maximum.

SQL Injection¶

Still number one. In JPA: use parameterized queries. Never JPQL with user input. For native SQL: PreparedStatement, never Statement.

XSS¶

Output encoding — every output to HTML must be escaped. In JSF this is the default (EL expressions). Watch out for h:outputText with escape=false.

CSRF¶

CSRF token in every form. JSF has built-in CSRF protection (ViewState). For REST APIs: custom token in an HTTP header.

Session Management¶

HTTPS everywhere. Cookie flags: Secure, HttpOnly, SameSite. Session timeout of 30 minutes (15 for banking). Session ID regeneration after login.

Security Headers¶

Apache reverse proxy adds: X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security.

Lesson Learned¶

Every application must go through a security audit. Internal code review is not enough — you need an external penetration test.