1. ESAPI Pictures
For Javadoc

2. Architecture Overview
Custom Enterprise Web Application
Enterprise Security API
Authenticator
User
AccessController
AccessReferenceMap
Validator
Encoder
HTTPUtilities
Encryptor
EncryptedProperties
Randomizer
Exception Handling
Logger
IntrusionDetector
SecurityConfiguration
Existing Enterprise Security Services/Libraries

3. OWASP Top Ten Coverage OWASP Top Ten OWASP ESAPI
A1. Cross Site Scripting (XSS)
A2. Injection Flaws
A3. Malicious File Execution
A4. Insecure Direct Object Reference
A5. Cross Site Request Forgery (CSRF)
A6. Leakage and Improper Error Handling
A7. Broken Authentication and Sessions
A8. Insecure Cryptographic Storage
A9. Insecure Communications
A10. Failure to Restrict URL Access
OWASP ESAPI
Validator, Encoder
Encoder
HTTPUtilities (upload)
AccessReferenceMap
User (csrftoken)
EnterpriseSecurityException, HTTPUtils
Authenticator, User, HTTPUtils
Encryptor
HTTPUtilities (secure cookie, channel)
AccessController

4. Enforcing Access Control
isAuthorizedForFunction()
isAuthorizedForData()
isAuthorizedForURL()
isAuthorizedForService()
User
Controller
Business Functions
Data Layer
Backend
Presentation Layer
isAuthorizedForFunction()
isAuthorizedForFile()
Roles

5. Handling Authentication and Identity
User
Controller
Business Functions
Data Layer
Backend
Presentation Layer
ESAPI
Authentication
Access Control
Logging
Intrusion Detection
Users

6. Handling Direct Object References
getDirectReference()
User
Controller
Business Functions
Data Layer
Backend
Presentation Layer
getIndirectReference()
Access
Reference
Map
Report123.xls
Acct:

7. Decoding/Encoding Untrusted Data
Codecs:
HTML Entity Codec
Percent Codec
JavaScript Codec
VBScript Codec
CSS Codec …
Decoding
Engine
Validation
Engine
User
Controller
Business Functions
Data Layer
Backend
PresentationLayer
Encode:
encodeForHTML()
encodeForHTMLAttribute()
encodeForJavaScript()
encodeForCSS()
encodeForURL()
Encode:
encodeForSQL()
encodeForLDAP()
encodeForXML()
encodeForXPath()
encodeForOS()
Encoding
Engine
Encoding
Engine

8. Validating Untrusted Input/Output
Validate:
getValidDate()
getValidCreditCard()
getValidSafeHTML()
getValidInput()
getValidNumber()
getValidFileName()
getValidRedirect()
safeReadLine() …
Validation
Engine
User
Controller
Business Functions
Data Layer
Backend
PresentationLayer
Validate:
getValidDate()
getValidCreditCard()
getValidInput()
getValidNumber() …
Validation
Engine

9. Enhancing HTTP HTTP Utilities User Controller Business Functions
Input Utilities:
assertSecureRequest()
getCSRFToken
getSafeFileUploads()
safeSendForward()
verifyCSRFToken() …
HTTP Utilities
User
Controller
Business Functions
Data Layer
Backend
Presentation Layer
Output Utilities:
addCSRFToken()
changeSessionIdentifier()
safeSetContentType()
setNoCacheHeaders()
setRememberToken()
verifyCSRFToken() …
HTTP Utilities

10. Security Logging User Controller Business Functions Data Layer Backend
Presentation Layer
ESAPI
Logging:
fatal()
error()
warning()
info()
debug()
trace() …
Logger

11. Logout User, Lock Account
Detecting Intrusions
User
Controller
Business Functions
Data Layer
Backend
Presentation Layer
ESAPI
Authentication
Logging
Quota
Exceeded
Intrusion Detection
Tailorable
Quotas
Users
Log Intrusion
Event
Logout User, Lock Account

12. Basic Cryptography User Controller Business Functions Data Layer
Backend
PresentationLayer
Crypto:
encrypt() / decrypt()
hash()
seal() / unseal()
sign()
verifySeal()
verifySignature()
Encryptor

13. new EncryptedProperties() Encrypted Properties File
set() / get()
User
Controller
Business Functions
Data Layer
Backend
PresentationLayer
Encryptor
Encrypted Properties
Encrypted Properties File

14. Safe OS Command Execution
executeSystemCommand()
User
Controller
Business Functions
Data Layer
Backend
PresentationLayer