ESAPI/esapi-java-legacy

Spring Security

Contextual output encoding for Java 8+: HTML, JavaScript, CSS, XML and URI components. Zero-dependency core with optional JSP and Jakarta adapters.

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

OWASP Benchmark is a test suite designed to verify the speed and accuracy of software vulnerability detection tools. A fully runnable web app written in Java, it supports analysis by Static (SAST), Dynamic (DAST), and Runtime (IAST) tools that support Java. The idea is that since it is fully runnable and all the vulnerabilities are actually exploitable, it’s a fair test for any kind of vulnerability detection tool. For more details on this project, please see the OWASP Benchmark Project home page.

Conscrypt is a Java Security Provider that implements parts of the Java Cryptography Extension and Java Secure Socket Extension.

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

A curated list of resources for learning about application security

OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.