Chapter 7 - Securing Your Java Code

Abstract

A tool as powerful as Java may still present some threat as long as there is room for error in its use. This chapter walks the user through the process of ensuring the Java code is sound and secure. To code secure Java applications, one must understand how Java security works and how the environment itself—and thus applications created in it—handles security. The user will also gain an understanding of Java's other weaknesses, and see how numerous bugs and exploits have caused Java to change over the years. For example, the chapter examines how it is possible to bring down a Java program by creating multiple threads that eventually bog down and crash the system. This chapter discusses four distinct areas of Java. The first section is an overview of the Java security architecture, where the concepts of basic security and the sandbox mechanism are introduced that allows most of Java's security to take place. Next, it discusses how Java handles security by exploring Java's built-in security mechanisms, which together comprise the Java sandbox. Next, it looks at potential weaknesses in Java from a developer's point of view. This section describes how others can exploit weaknesses to wreak havoc with one's Internet application. Finally, it gets into the nuts and bolts of coding functional, but secure, Java applets by looking at how to implement various security features, including authentication and encryption.