Servlet - Web Security

Objective: Based on Servlet specification explain the following security mechanisms:

1. Authentication: The process of validating the user. Usually implemented by using username and password.

• Eg: Providing user name and password to login into Gmail/bank website etc.

2. Authorization: The process of validating access permissions of a user — checking whether the user is allowed to access a particular resource or not. After authentication we have to perform authorization. Usually implemented by using Access Control List (ACL).

• Eg: Even though we are a valid customer of the bank, we are not authorized to access others' account information. We are authorized to access our account information only.

3. Data Integrity: The process of ensuring that data should not be changed during transportation from client to server. Implemented by using Secure Socket Layer (SSL).

• Eg: If we are sending a request to transfer 10000 Rs, the bank should get request for 10000 Rs only but not for 10 Lakhs.

4. Confidentiality: The process of ensuring that no one except the intended user is able to understand our information. Implemented by using encryption and decryption algorithms.

Authorization vs Confidentiality: Authorization prevents information from reaching unintended users in the first place. Confidentiality ensures that even if information falls in the wrong hands, it remains unreadable.

According to Servlet Specification, there are 4 types of Authentication mechanisms:

1. HTTP Basic Authentication
2. HTTP Form Based Authentication
3. HTTP Digest Authentication
4. HTTPS Client Cert Authentication

Simplest and most commonly used. Introduced in HTTP 1.1 Specification.

Process:

1. Browser sends a request to the server (doesn't know if resource is protected)
2. Server checks if resource is secured → if yes, returns 401 status code
3. Browser opens a dialogue box prompting for username and password
4. User enters credentials → browser resends the request with credentials
5. Server validates → if valid, provides response; if invalid, returns 401 again

Advantages:

• Very easy to implement and set up
• All browsers support this authentication

Limitations:

• Username and password are sent in plain text form (Base64 encoding, not encryption) → security is very low
• Cannot customize look and feel of dialogue box

Exactly same as Basic Authentication, except that password is sent in encrypted form. Hence more secure than Basic Authentication.

Advantage: More secured than Basic Authentication.

Limitations:

• Most browsers won't provide support (browser is responsible for encryption)
• Most servers won't provide support (server is responsible for decryption). Even Servlet Specification does not mandate support for Digest authentication.
• Cannot change look and feel of the dialogue box

Exactly same as Basic Authentication except that instead of depending on browser's dialogue box, we can provide our own login HTML form. Developer is responsible for providing login and error pages, so we can customize look and feel.

Requirements of the login form:

• The value of action attribute should be j_security_check
• The form should contain compulsory 2 text fields with names j_username and j_password

<form action="j_security_check">
  username: <input type="text" name="j_username">
  pwd: <input type="text" name="j_password">
  <input type="submit">
</form>

Advantages:

• Very easy to setup
• All browsers and servers support
• Can customize look and feel of login form

Limitation: Username and password are sent in plain text form → security is less.

HTTPS means HTTP over Secure Socket Layer (SSL). SSL is a protocol to ensure privacy of sensitive data transferred over the network.

In this mechanism, authentication is performed when SSL connection is established between client and server. Total data is transmitted in encrypted form by using public key cryptography, which can be handled by both browser and server.

Advantage: It is the most secured type of authentication.

Limitations:

• Very costly to implement and maintain
• Requires a certificate from 3rd party certificate authority like VeriSign etc.