Java Spring Boot: examples of basic security features

Java Spring Boot is a framework for building Java applications. It is based on the popular Spring framework and provides a number of additional features and tools to make it easier to build Java applications.

Some of the key features of Spring Boot include:

• Auto-configuration: Spring Boot provides auto-configuration support. That means that it can automatically configure your application based on the dependencies you have added to your project.
• Embedded servers: Spring Boot comes with support for embedded servers. You can run your application as a standalone application without the need for a separate application server. It helps the development efficiency.
• CLI: Spring Boot provides a command-line interface (CLI) that allows you to easily create and run Spring Boot applications.
• Actuator: Spring Boot provides an actuator, which is a set of tools that allow you to monitor and manage your application.

Spring Boot is a powerful framework that makes it easier to build and deploy Java web-based applications. It is widely used by developers around the world and is supported by a large and active community.

In this short article, we’ll share some examples of Spring Boot’s security features.

SQL Injection Prevention

There are several ways that developers can use Spring Boot to handle SQL injection attacks on user input:

1. Use prepared statements: Spring Boot provides support for using prepared statements, which automatically escape user input before it is passed to a SQL query. This can help prevent injection attacks. For example:

   String sql = "SELECT * FROM users WHERE name = ?"; 
   SqlRowSet rowSet = jdbcTemplate.queryForRowSet(sql, name);

   In this example, the name variable is automatically escaped by Spring Boot before being passed to the SQL query.

2. Use named parameters: Spring Boot also supports the use of named parameters in SQL queries, which can help prevent injection attacks. For example:

   String sql = "SELECT * FROM users WHERE name = :name";
   MapSqlParameterSource parameters = new MapSqlParameterSource();
   parameters.addValue("name", name);
   SqlRowSet rowSet = namedParameterJdbcTemplate.queryForRowSet(sql, parameters);

   In this example, the name parameter is automatically escaped by Spring Boot before being passed to the SQL query.

3. Use JPA queries: Spring Boot’s Java Persistence API (JPA) provides support for building safe and secure queries using a type-safe, object-oriented approach. For example:

   String name = "Bob'; DROP TABLE users;--";
   List<User> users = entityManager.createQuery("SELECT u FROM User u WHERE u.name = :name", User.class)
     .setParameter("name", name)
     .getResultList();

   In this example, the name parameter is automatically escaped by Spring Boot before being passed to the SQL query.

Securing File Upload

There are several ways that developers can use Spring Boot to secure a file upload feature, including validation, hashing, and sanitization:

1. Validation: Spring Boot provides support for validating uploaded files using the @Valid and @Validated annotations. For example:

   public class FileUploadForm {
   
     @NotNull
     @Size(min = 1, max = 50)
     private String name;
   
     @NotNull
     @Size(min = 1)
     private MultipartFile file;
     
       // Getters and setters
   }
   
   @PostMapping("/upload")
   public String handleFileUpload(@ModelAttribute @Valid FileUploadForm form, BindingResult result) {
     if (result.hasErrors()) {
       return "uploadForm";
     }
   
     // Save the file and return a success message
   }

   In this example, the @Valid annotation is used to validate the FileUploadForm object and the @Size annotation is used to ensure that the name and file fields meet certain size requirements. If the validation fails, the user is shown an error message.

2. Hashing: Spring Boot provides support for generating hashes of uploaded files using the MessageDigest class. For example:

   public String generateHash(MultipartFile file) throws NoSuchAlgorithmException, IOException {
     MessageDigest digest = MessageDigest.getInstance("SHA-256");
     byte[] hash = digest.digest(file.getBytes());
     return Base64.getEncoder().encodeToString(hash);
   }

   In this example, the MessageDigest class is used to generate a SHA-256 hash of the uploaded file. The hash is then encoded using Base64 encoding. You can later on use this hash value to make sure file isn’t tampered with.
3. Sanitization: Spring Boot does not provide any built-in support for sanitizing uploaded files. However, developers can use external libraries or custom code to sanitize uploaded files before storing them on the server.
   

   public void sanitizeFile(MultipartFile file) throws IOException {
     // Use an external library or custom code to sanitize the file
     File sanitizedFile = sanitize(file);
   
     // Save the sanitized file to the server
     file.transferTo(new File("/path/to/storage"));
   }

   One of the frameworks you may consider for file scanning is ClamAV. There are also several ClamAV REST API implementations available on GitHub.

Saving session data securely

Developers can save session data securely in Spring Boot by using the HttpSession interface and the Session annotation.

The HttpSession interface provides a number of methods for storing, retrieving, and deleting session data. For example:

@GetMapping("/login")
public String login(HttpSession session) {
  session.setAttribute("user", "Alice");
  return "login";
}

@GetMapping("/profile")
public String profile(HttpSession session) {
  String user = (String) session.getAttribute("user");
  return "Hello, " + user;
}

In this example, the setAttribute method is used to store data in the session, and the getAttribute method is used to retrieve it. The session data is stored in an encrypted cookie on the user’s device, which helps prevent the data from being accessed by unauthorized parties.

It is important to note, however, that no framework can completely eliminate the risk of security vulnerabilities in session management. Software engineers should still be aware of the latest security threats and vulnerabilities and follow best practices for secure coding. Read more about this here.