Secure by Default Web Applications With Apache Sling Robert - - PowerPoint PPT Presentation

▶
secure by default web applications with apache sling
SMART_READER_LITE
LIVE PREVIEW

Secure by Default Web Applications With Apache Sling Robert - - PowerPoint PPT Presentation

Feb 07, 2023 199 likes •610 views

Secure by Default Web Applications With Apache Sling Secure by Default Web Applications With Apache Sling Robert Munteanu, Adobe Systems ApacheCon Core 2016 http://robert.muntea.nu @rombert Who I am $DAYJOB Open Source Adobe

slide-1
SLIDE 1

http://robert.muntea.nu @rombert

Secure by Default Web Applications With Apache Sling

Secure by Default Web Applications With Apache Sling Robert Munteanu, Adobe Systems ApacheCon Core 2016

slide-2
SLIDE 2

http://robert.muntea.nu @rombert

Who I am

 $DAYJOB

 Adobe Experience

Manager

 Apache Sling  Apache Jackrabbit  Apache Felix

 Open Source

 Apache Sling  MantisBT  Mylyn Connector for

MantisBT

 Mylyn Connector for Review

Board

slide-3
SLIDE 3

http://robert.muntea.nu @rombert

Purpose of the talk Scope Cost Schedule

slide-4
SLIDE 4

http://robert.muntea.nu @rombert

Purpose of the talk Scope Cost Schedule

slide-5
SLIDE 5

http://robert.muntea.nu @rombert

Purpose of the talk Scope Cost Schedule

slide-6
SLIDE 6

http://robert.muntea.nu @rombert

Agenda

  • Apache Sling
  • Demo application review
  • Threat model
  • Security with Apache Sling
  • Demo
  • Conclusion
  • Q&A
slide-7
SLIDE 7

http://robert.muntea.nu @rombert

Apache Sling – Brief History

2007

Incubation

2009

TLP

2015

Version 8

200x

Pre-Apache

slide-8
SLIDE 8

http://robert.muntea.nu @rombert

Apache Sling – Code Statistics

slide-9
SLIDE 9

http://robert.muntea.nu @rombert

Apache Sling – Contributor activity

slide-10
SLIDE 10

http://robert.muntea.nu @rombert

Apache Sling – Value proposition

  • Content-oriented
  • RESTful
  • Lightweight
  • Integrated authentication and authorization
  • OSGi-powered
  • Scripting inside
  • Easily deployable
slide-11
SLIDE 11

http://robert.muntea.nu @rombert

Apache Sling – Content-Oriented

Blog posts Images Users and Groups

slide-12
SLIDE 12

http://robert.muntea.nu @rombert

Apache Sling – Content-Oriented

Server-side templates and scripts

Configurations

slide-13
SLIDE 13

http://robert.muntea.nu @rombert

Apache Sling – RESTful $ h t t p l

  • c

a l h

  • s

t : 8 8 / c

  • n

t e n t / ↵ b l

  • g

/ p

  • s

t s / h e l l

  • _

w

  • r

l d . h t m l j s

  • n

x m l t x t p d f p h p 3

slide-14
SLIDE 14

http://robert.muntea.nu @rombert

Apache Sling – RESTful

slide-15
SLIDE 15

http://robert.muntea.nu @rombert

Apache Sling – Persistence via JCR

slide-16
SLIDE 16

http://robert.muntea.nu @rombert

Apache Sling – Topologies Standalone High Availability

slide-17
SLIDE 17

http://robert.muntea.nu @rombert

Agenda

  • Apache Sling
  • Demo application review
  • Threat model
  • Security with Apache Sling
  • Demo
  • Conclusion
  • Q&A
slide-18
SLIDE 18

http://robert.muntea.nu @rombert

Demo App – main page

slide-19
SLIDE 19

http://robert.muntea.nu @rombert

Demo App – Article Page

slide-20
SLIDE 20

http://robert.muntea.nu @rombert

Demo App – Submitting comments

slide-21
SLIDE 21

http://robert.muntea.nu @rombert

Agenda

  • Apache Sling
  • Demo application review
  • Threat model
  • Security with Apache Sling
  • Demo
  • Conclusion
  • Q&A
slide-22
SLIDE 22

http://robert.muntea.nu @rombert

Threat modelling

“Threat modeling is an engineering technique you can use to help you identify threats, attacks, vulnerabilities, and countermeasures that could afgect your application”

Threat Modeling Web Applications on MSDN

slide-23
SLIDE 23

http://robert.muntea.nu @rombert

Threat Modelling - Assets

slide-24
SLIDE 24

http://robert.muntea.nu @rombert

Threat Modelling - Assets

  • Availability
  • Content
  • User Credentials
  • Ability to execute code on server
  • Ability to execute code in the browser context
slide-25
SLIDE 25

http://robert.muntea.nu @rombert

Threat Modelling - Trust Levels

slide-26
SLIDE 26

http://robert.muntea.nu @rombert

Threat Modelling - Trust Levels

  • 1. Anonymous
  • 2. Author
  • 3. Administrator
slide-27
SLIDE 27

http://robert.muntea.nu @rombert

Threat Modelling - Threats

OWASP

slide-28
SLIDE 28

http://robert.muntea.nu @rombert

Threat Modelling - Threats

  • 1. Denial of Service
  • 2. Defacement / Deletion
  • 3. Leaking credentials
  • 4. SQL/Shell Injection
  • 5. Stored/Reflected XSS
slide-29
SLIDE 29

http://robert.muntea.nu @rombert

Threat Modelling - Mitigation

slide-30
SLIDE 30

http://robert.muntea.nu @rombert

Agenda

  • Apache Sling
  • Demo application review
  • Threat model
  • Security with Apache Sling
  • Demo
  • Conclusion
  • Q&A
slide-31
SLIDE 31

http://robert.muntea.nu @rombert

Apache Sling Security – Natural layering of ACEs

slide-32
SLIDE 32

http://robert.muntea.nu @rombert

Apache Sling Security – Security applied at the lowest level

$ h t t p

  • a

u t h b

  • b

: b

  • b

l

  • c

a l h

  • s

t : 8 8 / c

  • n

t e n t / b l

  • g

/ p

  • s

t s / n e w _ b l

  • g

_ p

  • s

t ' j c r \ : t i t l e = N e w p

  • s

t '

slide-33
SLIDE 33

http://robert.muntea.nu @rombert

Apache Sling Security – Context-aware templating language < d i v c l a s s = " c

  • m

m e n t c l e a r f i x " > < i m g c l a s s = " a v a t a r i m g

  • r
  • u

n d e d p u l l

  • l

e f t " s r c = " $ { r e s

  • u

r c e . v a l u e M a p [ ' a u t h

  • r

A v a t a r ' ] } " / > < h 3 > $ { r e s

  • u

r c e . v a l u e M a p [ ' j c r : t i t l e ' ] } < / h 3 > < p > $ { r e s

  • u

r c e . v a l u e M a p [ ' j c r : d e s c r i p t i

  • n

' ] } < / p > < / d i v >

slide-34
SLIDE 34

http://robert.muntea.nu @rombert

Apache Sling Security – Injection-safe APIs Children of /content/blog/posts

slide-35
SLIDE 35

http://robert.muntea.nu @rombert

Apache Sling Security – Injection-safe APIs Children of /content/blog/comments/ hello_world

slide-36
SLIDE 36

http://robert.muntea.nu @rombert

Agenda

  • Apache Sling
  • Demo application review
  • Threat model
  • Security with Apache Sling
  • Demo
  • Conclusion
  • Q&A
slide-37
SLIDE 37

http://robert.muntea.nu @rombert

Demo Application – Actual demo!!!!1oneone

slide-38
SLIDE 38

http://robert.muntea.nu @rombert

Conclusions – Security

  • Aim to be “Secure by Default”
  • Build a threat model for your application
  • Look for components that eliminate problems

altogether

slide-39
SLIDE 39

http://robert.muntea.nu @rombert

Conclusions – Apache Sling

  • Simple to be “Secure by Default”
  • Eventing, Thread Pooling, Job Management,

Caching

  • Scripting: Groovy, Scala, JSP, Sightly, Java, Ruby,

Thymeleaf

  • Flexible resource rendering with resource types
  • Very extensible due to being internally powered by

OSGi – most extension points available to clients

slide-40
SLIDE 40

http://robert.muntea.nu @rombert

Resources

  • Apache Sling – https://sling.apache.org
  • Apache Jackrabbit
  • https://jackrabbit.apache.org
  • http://jackrabbit.apache.org/oak/
  • OWASP - https://www.owasp.org
  • https://www.owasp.org/index.php/OWASP_Top_Ten

_Cheat_Sheet

  • https://www.owasp.org/index.php/Application_Thre

at_Modeling