Secure Coding Practices in Java: Challenges and Vulnerabilities

TL;DR

This study analyzes StackOverflow discussions to identify key challenges and vulnerabilities in Java secure coding, highlighting issues with cryptography, Spring security, and common insecure coding practices.

Contribution

It provides an empirical analysis of developer concerns, challenges, and vulnerabilities in Java secure coding, especially in authentication, authorization, and cryptography APIs.

Findings

Developers face challenges with cryptography and Spring security APIs.

Common vulnerabilities include insecure hash functions and SSL/TLS bypasses.

Security issues are often due to insufficient secure coding guidance.

Abstract

Java platform and third-party libraries provide various security features to facilitate secure coding. However, misusing these features can cost tremendous time and effort of developers or cause security vulnerabilities in software. Prior research was focused on the misuse of cryptography and SSL APIs, but did not explore the key fundamental research question: what are the biggest challenges and vulnerabilities in secure coding practices? In this paper, we conducted a comprehensive empirical study on StackOverflow posts to understand developers' concerns on Java secure coding, their programming obstacles, and potential vulnerabilities in their code. We observed that developers have shifted their effort to the usage of authentication and authorization features provided by Spring security--a third-party framework designed to secure enterprise applications. Multiple programming challenges are related to APIs or libraries, including the complicated cross-language data handling of cryptography APIs, and the complex Java-based or XML-based approaches to configure Spring security. More interestingly, we identified security vulnerabilities in the suggested code of accepted answers. The vulnerabilities included using insecure hash functions such as MD5, breaking SSL/TLS security through bypassing certificate validation, and insecurely disabling the default protection against Cross Site Request Forgery (CSRF) attacks. Our findings reveal the insufficiency of secure coding assistance and education, and the gap between security theory and coding practices.