Security

This chapter focuses on essential security practices in software development, emphasizing the importance of integrating security from its conception. It explores principles such as encryption, authentication, and authorization and techniques to safeguard data at rest and in transit. The chapter highlights common threats such as denial-of-service (DoS) attacks, input injection, output encoding, cross-site request forgery (CSRF), and cross-site scripting (XSS) and discusses defense mechanisms to avoid them.

The chapter also introduces security frameworks, including Zero Trust Architecture (ZTA), threat modeling, and the Open Worldwide Application Security Project (OWASP).

In addition, the chapter provides an in-depth discussion of Open Authorization 2.0 (OAuth2) and OpenID Connect (OIDC) for securing user authentication and authorization with a practical implementation utilizing Spring Authorization Server.

This chapter covers the following:

• Reviewing key security...