Java Common web vulnerabilities
The OWASP entries that actually reach a Java service, and the fix that works rather than the one that looks like it works.
3 concepts · 9 interview questions
What this topic covers
Every concept in common web vulnerabilities, and the questions each one gets asked as. Where a question links, it has a full write-up.
Injection
Untrusted input interpreted as code or query structure. The fix is always separating data from instruction, never escaping harder.
- How do you prevent SQL injection?
- Does using JPA make you safe from injection?
- What other kinds of injection affect a Java service?
XSS and CSRF
One executes attacker script in a user's browser; the other makes the user's browser issue a request they did not intend. Different problems, different fixes.
- What is the difference between XSS and CSRF?
- How do you prevent XSS properly?
- Why does a stateless API often not need CSRF protection?
SSRF and unsafe deserialisation
Two Java-flavoured classics: making the server fetch a URL an attacker chose, and reconstructing objects from bytes an attacker supplied.
- What is SSRF, and why is it worse in a cloud environment?
- Why is Java deserialisation dangerous?
- How do you handle untrusted input safely instead?