Working with Security Features
1. Using Java Security Manager
Warning:
SecurityManager is deprecated for removal since Java 17 (JEP 411). Do not adopt for new code. Use OS-level isolation (containers), JPMS encapsulation, and input validation instead.
| Status | Java Version |
|---|---|
| Active default | 1.0–17 |
| Deprecated for removal | 17 (JEP 411) |
| Disabled default | Java 18+ (-Djava.security.manager=disallow) |
| Removed | Targeted Java 25+ |
2. Configuring Security Policies
| File | Use |
|---|---|
$JAVA_HOME/conf/security/java.policy | Default grants |
| Per-app policy | -Djava.security.policy=app.policy |
| Format | grant codeBase "...". { permission ...; } |
| Status | Tied to deprecated SecurityManager |
3. Using Security Manager Alternatives (Java 17+)
| Alternative | Use |
|---|---|
| JPMS encapsulation | Limit reflective access |
| Container isolation | Linux namespaces, seccomp, AppArmor |
| Process isolation | Multi-process design |
| Input validation | OWASP-style at boundaries |
| Serialization filters | ObjectInputFilter |
4. Working with Cryptography (JCE)
| Class | Use |
|---|---|
| MessageDigest | Hash (SHA-256, SHA3) |
| Mac | HMAC |
| Cipher | Symmetric/asymmetric encrypt |
| Signature | Sign/verify |
| KeyAgreement | DH/ECDH |
5. Using MessageDigest
Example: SHA-256
byte[] hash = MessageDigest.getInstance("SHA-256")
.digest("hello".getBytes(StandardCharsets.UTF_8));
String hex = HexFormat.of().formatHex(hash);| Algorithm | Use |
|---|---|
| SHA-256 / SHA-384 / SHA-512 | General-purpose |
| SHA3-256 etc. | NIST SHA-3 |
| MD5 / SHA-1 | DEPRECATED non-security only |
6. Using Cipher
Example: AES-GCM
byte[] iv = new byte[12]; new SecureRandom().nextBytes(iv);
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
byte[] ct = c.doFinal(plain);| Mode | Use |
|---|---|
| AES/GCM/NoPadding | Authenticated encryption (preferred) |
| ChaCha20-Poly1305 | Modern AEAD alt |
| RSA/ECB/OAEPWith... | Asymmetric encryption |
| AES/CBC/PKCS5Padding | Legacy; use only with HMAC |
7. Working with KeyStore
| Type | Use |
|---|---|
| PKCS12 | Default since Java 9 |
| JKS | Legacy proprietary |
| Operations | load/store, getKey, getCertificate |
| Tool | keytool |
8. Using SecureRandom
| API | Use |
|---|---|
SecureRandom.getInstanceStrong() | Strong (may block on Linux NativePRNGBlocking) |
new SecureRandom() | Default (DRBG on modern JDK) |
| DRBG | NIST SP 800-90A; configure via SecureRandomParameters |
| NEVER | Use Random or Math.random() for crypto |
9. Implementing SSL/TLS Connections
| API | Use |
|---|---|
SSLContext.getInstance("TLSv1.3") | TLS 1.3 (Java 11+) |
| init(km, tm, sr) | Key/trust managers |
| SSLSocketFactory / SSLEngine | Blocking / non-blocking |
| HttpClient | .sslContext(ctx).sslParameters(p) |
| Hostname verification | Enabled by default in HttpClient |
10. Using JAAS (authentication, authorization)
| Component | Use |
|---|---|
| LoginContext | Authenticate |
| LoginModule | Pluggable mechanism (Krb5, LDAP) |
| Subject + Principal | Identity carrier |
| Subject.doAs | Run-as (tied to SecurityManager — declining) |
11. Understanding Security Providers
| Aspect | Detail |
|---|---|
| Provider class | Registers algorithms |
| Built-ins | SunJCE, SunEC, SunPKCS11, SunMSCAPI |
| Bouncy Castle | Popular 3rd-party |
| Selection | Security.getProviders() or by name in getInstance() |
12. Preventing Common Vulnerabilities
| Vulnerability | Prevention |
|---|---|
| SQL injection | PreparedStatement with parameters |
| XXE | Disable DTDs in XML parsers |
| Deserialization RCE | ObjectInputFilter / avoid Java serialization |
| JNDI injection (Log4Shell) | Validate/escape user input; patch logging libs |
| Path traversal | Validate normalized paths against base |
| Command injection | ProcessBuilder with arg list (not concatenated string) |
| Insecure TLS | Use TLS 1.2/1.3, validate hostnames |
| Weak crypto | AES-GCM ≥ 128, RSA ≥ 2048, ECDSA P-256+ |