REST API Security with Java Spring Boot - What & How

Explore how REST APIs in Java Spring Boot act as gateways between software components, how unsecured APIs enable data breaches, and how penetration testing reveals threats and prevention techniques.

Explore hands-on code to build and mitigate security threats in a Spring Boot 2 API using Java 15, PostgreSQL, and Postman, with downloadable resources and references.

Follow a hands-on start to building Java Spring Boot REST API security, including local Postgres and Redis setup, configuration with application.yml, swagger documentation, and testing with Postman.

Explore sql injection threats from dynamic code built on user input, where dangerous queries can run, and learn why frameworks don’t fully prevent vulnerable string-joined sql in api access.

Demonstrate sql injection vulnerabilities by building vulnerable code with Spring JdbcTemplate, including methods to find by email and by gender and to create customers. Expose how stored procedures and Spring Data repositories can still be vulnerable when dynamic sql or unsafely bound parameters are involved.

Explore SQL injection testing in a Java Spring Boot REST API, showing how string concatenation creates vulnerable queries and can drop tables via Postman.

Implement a safe JdbcCustomerSafeRepository using prepared statements and named parameters, then compare dangerous and safe apis by testing email and gender queries to prevent sql injection.

Build a SQL injection filter in Spring Boot that sanitizes input with regex, blocks dangerous queries, and validates email and gender codes using Spring validations.

Demonstrates securing sql queries and preventing sql injection by fixing stored procedures alongside java, restores jdbc_merchant after unsafe inputs, and shows re-running apisecurity.sql plus applying the stored procedure fix.

Explore how to prevent exposing stack traces in sql injection scenarios, implement a generic ApiErrorMessage, and handle SQLException with RestControllerAdvice to log details and return a safe error.

Shows that a framework alone doesn’t guarantee sql-injection safety: compare JPA with dynamic JPQL, using JpaCustomerDangerDAO, an EntityManager, and a RestController at /api/sqlinjection/danger/v2.

Explore how a vulnerable data access path in a JPA repository and string-joined DAO can enable SQL injection, exposing all customer data despite prepared statements.

Show how to prevent sql injection in jpa by using parameterized input in JpaCustomerSafeDAO and a /safe API, tested via the Postman collection 'JPA Safe'.

Enforce least authority by creating a limited Postgres user with CRUD access and updating credentials. Restructure code to use Spring Data JDBC and place it under the sqlinjection sub-package.

Explore defense-in-depth against sql injection by using prepared statements, least-privilege access, input sanitization and validation, and credential rotation with tools like Spring and Vault. Understand how WAFs, logging, audits, and API proxies help detect and block attacks in legacy systems.

Discover how Java and Spring provide multiple relational database options, from vanilla JDBC to Spring Data JDBC or JPA, while avoiding dynamic SQL to prevent injection.

Learn how cross-site scripting threatens rest api security, with reflective cross-site scripting and persistent cross-site scripting, to steal cookies, capture keystrokes, and leak sensitive data via browser-side scripts.

Demonstrate xss vulnerability by building a simple rest api greet endpoint at /api/xss/danger/v1 that returns a time-based message, served with an html fetch page and a downloadable xss example file.

Test vulnerable code for xss using Postman and browser, observing reflection of the name parameter in greeting responses and alert execution on dangerous input, plus a file download scenario.

Explore how XSS vulnerabilities appear in ReactJS front-ends and learn to secure a Spring Boot REST API with cross-origin access, article creation, and search.

Explore how a vulnerable rest api and react frontend handle xss by creating a sample app, inserting dangerous strings into articles, and observing script execution in the browser.

Explore XSS prevention for REST APIs by validating and sanitizing input, enforcing JSON payload rules and 415 responses, encoding outputs, and applying headers such as content-type, CSP, X-XSS-Protection, and nosniff.

Implement an xss input filter in a Spring Boot app, using regex patterns to block dangerous input in query, path, and body, and enforce json content type for safety.

Encode output with the OWASP encoder to prevent xss, explicitly set content types in Spring endpoints, and use tika to determine file content type for safe downloads.

Create a global xss response filter to add headers, including xss-protection and nosniff, with a basic content-security-policy. Move inline scripts to greeting.js, use a nonce, and test CSP.

Explore how API management eases security burden by offloading token handling, rate limiting, and common functions behind a gateway, while preserving consistent logic across services.

Explore where to place security code across API deployment layers and implement threat prevention in REST APIs with Java Spring Boot.

discover how a denial of service attack overwhelms api resources with massive traffic from a single bad client or from many ip addresses in a distributed attack.

Demonstrates simulating DoS scenarios in a Java Spring Boot API with /green, /blue, /red, and /random-colors endpoints returning hex colors. Shows configuring RestController classes and logging for requests with jmeter.

Explore DoS testing of vulnerable code using Postman and JMeter to simulate high load, observe cpu spikes and 200 ok responses, and understand how massive requests reveal API vulnerabilities.

Prevent DoS by applying IP restriction at the firewall with a whitelist or blacklist, and combine rate limiting with pagination to protect public and private APIs.

Implement defense in depth with multi-layer rate limiting and http filters, managed by an API gateway, protecting microservices with firewall, WAF, and load balancer support.

Create WhitelistIpFilter extending OncePerRequestFilter and annotate with @Component to enforce an IP whitelist. Test by hitting the green endpoint; localhost IPv6 and a dummy IPv4 address are used.

Implement per-second rate limiting in a spring boot app using Google Guava's RateLimiter, with blue 3 tps and red 2 tps, returning 429 and optional retry-after to protect APIs.

Explore safe pagination for a random color endpoint in Spring Boot. Define HexColorPaginationResponse and enforce page size constraints (10–100) with @Validated, min, and max.

Differentiate encoding, encryption, and hashing to secure data; learn why encoding is not security, how encryption protects data with keys, and how hashing with salt validates integrity.

Explore encode, decode, and hash concepts by building encode decode utilities and AES encryption with IV, plus base64, URL encoding, sha-256, and bcrypt hashing with salt in Spring Boot.

Explore why base64 encoding has drawbacks for binary transfers and learn safer alternatives like multipart attachments and URL-encoded parameters, plus how encryption and hashes (HMAC) protect data integrity.

Understand how hmac ensures data integrity by using a shared secret to sign messages, allowing the server to verify signatures and detect tampering, with nonce providing unique per-message signatures.

Implement hmac security in Java Spring Boot with sha256 and a hardcoded secret key. Build a hmac util, hmac request, and /api/hmac, plus nonce-based replay protection expiring in five minutes.

Implement basic authentication for APIs using the HTTP Authorization header with base64-encoded username and password, recognize pitfalls like URL exposure and insecure base64, and decide which endpoints require auth.

Enable basic authentication by encrypting usernames with AES256-CBC, hashing passwords with bcrypt, and securing the /time endpoint with a BasicAuthFilter and repository-backed user data.

Explore the security risk of using http basic authentication, the role of the www-authenticate header, and how browsers may save credentials on shared/public computers.

Discover how attackers use rogue wifi to sniff data on public networks, intercept network packets, and steal sensitive information like usernames, passwords, or credit card numbers from unsecure websites.

Enable https to secure data in transit with tls certificates and certificate authorities, including self-signed options for development, and configure spring boot to use keystores and ssl offloading in production.

expose the api only over https and apply hsts to enforce https in browsers, using a reverse proxy to redirect http to https with a valid ssl certificate.