Security of Java Applications

This book is a practical guide to ensuring the security of Java applications. It covers key aspects of protecting code, data, and infrastructure that developers and architects encounter in their daily work. The author, Alexey Sokolov, shares years of experience and real-world examples from the industry to help readers avoid common mistakes and build reliable protection.

What is this book about?

The book starts with the basics: what application security is, what threats exist, and how to model them. Then it sequentially covers:

• Major vulnerabilities of web applications in Java (SQL injection, XSS, CSRF, SSRF) and ways to prevent them.
• Working with encryption and hashing: using JCA/JCE, key management, secure password storage.
• Authentication and authorization: OAuth2, JWT, Spring Security, protecting REST API.
• Multithreading and serialization security: deserialization attacks, race conditions.
• Code analysis and automated security testing: static and dynamic analysis, integration with CI/CD.
• Protection against infrastructure-level attacks: secure configuration of Tomcat, Jetty, Spring Boot.

Who is this book for?

This book will be useful for:

• Java developers who want to write secure code from the start.
• Architects and technical leads responsible for project security.
• DevSecOps specialists implementing secure development practices.
• Students and novice programmers learning Java and interested in cybersecurity.

What will the reader learn?

• How to identify and eliminate vulnerabilities in Java code.
• How to properly use cryptographic libraries and APIs.
• How to protect web applications from common attacks.
• How to configure secure authentication and session management.
• How to integrate automated security checks into the development process.
• How to respond to security incidents and conduct code audits.

Each chapter contains practical examples, ready-to-use code snippets, and recommendations for configuring tools. The book is focused on Java 17+ and modern frameworks (Spring Boot 3, Jakarta EE).

"Security of Java Applications" is not just a collection of theory, but a desktop reference for everyone who wants to create reliable and secure Java solutions.