Applying a mature web security framework will help developers to reduce a lot of the design and coding effort required to meet security requirements, since the web security framework itself provides the necessary security controls, such as authentication, authorization, logging, validation, encryption, and session management. To build web services, the followings are some popular open-source Java security frameworks under Apache 2.0 license:
- Spring Security
- Apache Shiro
- PicketLink
- Object Access Control (OACC) Framework
Some large organizations may prefer to build or to customize a web security framework for every project to use. No matter what security framework is used, it normally includes the following common security modules.
An organization-level security assurance program may suggest a list of mature security frameworks, or even provide a common...