Security Basics

Introduction

Java security spans crypto, input validation, dependency hygiene and authentication. You don't need to be a cryptographer — you need to know which APIs to call and which traps to avoid.

Understanding the topic

The fundamentals:

• 🔑 Hash passwords with BCrypt / Argon2 — never MD5 or SHA-1 raw.
• 🛡 Parameterise SQL (PreparedStatement, JPA) to defeat SQL injection.
• 🪪 Use JWT with strong signing keys (HS256 ≥ 256-bit; or RS256).
• 🔒 Always TLS in transit; verify certs.
• 📦 Scan dependencies (OWASP Dependency-Check, Snyk) — Log4Shell taught us why.
• 🚫 Don't roll your own crypto — use javax.crypto with audited algorithms.

Real-world use

Log4Shell (CVE-2021-44228) exploited a single feature — message lookups — in Log4j to achieve remote code execution. Companies that lacked dependency-scanning tooling spent millions on incident response. The lesson: SBOM + automated scanning is non-negotiable in 2026.

Best practices

• Centralise auth (Spring Security) — don't reinvent it per endpoint.
• Treat every input from the network as hostile.
• Rotate secrets; never commit them to git (use Vault / AWS Secrets Manager).

Purpose of this lesson

Master Security Basics so you can apply it confidently in production Java code, technical interviews, and code reviews.

Step-by-step explanation

1. Understand the core idea behind Security Basics.
2. Walk through the runnable example and tweak it in the playground.
3. Apply the pattern in a small Spring Boot or CLI exercise of your own.
4. Re-read the common mistakes and interview Q&A to lock the concept in.

Interactive workflow diagram

Debugging tips

• Never log raw passwords, tokens, or PII — scrub at the appender layer.
• Use java.security.SecureRandom, never Math.random(), for tokens.

Optimization strategies

• Profile before optimizing — JFR (Java Flight Recorder) and async-profiler reveal real hotspots.
• Prefer immutable data and stream pipelines over hand-rolled loops when readability matters.
• Reach for the right JDK collection (ArrayList vs LinkedList vs ArrayDeque) before writing custom data structures.

Enterprise example

Teams at Netflix, Uber and Goldman Sachs apply Security Basics daily — usually wrapped behind Spring Boot services with observability hooks (Micrometer + OpenTelemetry).

Interview questions & answers

Summary

In this lesson you learned Security Basics — the concept, syntax, a runnable example, and the production pitfalls to avoid. Apply it in the playground before moving on.