10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

30<br />

CHAPTER 30<br />

SecuringWeb Applications<br />

Web applications contain resources that can be accessed by many users. <strong>The</strong>se resources often<br />

traverse unprotected, open networks, such as the Internet. In such an environment, a<br />

substantial number of web applications will require some type of security.<br />

<strong>The</strong> ways to implement security for <strong>Java</strong> <strong>EE</strong> applications are discussed in a general way in<br />

“Securing Containers” on page 772. This chapter provides more detail and a few examples that<br />

explore these security services as they relate to web components.<br />

<strong>Java</strong> <strong>EE</strong> security services can be implemented for web applications in the following ways:<br />

■ Metadata annotations (or simply, annotations) are used to specify information about<br />

security within a class file. When the application is deployed, this information can either be<br />

used by or overridden by the application deployment descriptor.<br />

■ Declarative security expresses an application’s security structure, including security roles,<br />

access control, and authentication requirements in a deployment descriptor, which is<br />

external to the application.<br />

Any values explicitly specified in the deployment descriptor override any values specified in<br />

annotations.<br />

■ Programmatic security is embedded in an application and is used to make security decisions.<br />

Programmatic security is useful when declarative security alone is not sufficient to express<br />

the security model of an application.<br />

Some of the material in this chapter assumes that you have already read Chapter 28,<br />

“Introduction to Security in the <strong>Java</strong> <strong>EE</strong> Platform.” This chapter also assumes that you are<br />

familiar with the web technologies discussed in Chapter 3, “Getting Started with Web<br />

Applications,” Chapter 5, “<strong>Java</strong>Server Pages Technology,” and Chapter 10, “<strong>Java</strong>Server Faces<br />

Technology.”<br />

835

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!