Category:OWASP Enterprise Security API

=OWASP Enterprise Security API (ESAPI) Project=

The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway. Developers can use this API as a starting point for their own implementation using their company's infrastructure, or, they can use the fully functional reference implementation as a starting point.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over developers that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

The OWASP ESAPI project is led by Jeff Williams, who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995.

Download Now
This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the OWASP ESAPI mailing list and help make ESAPI better!


 * Javadoc online
 * Code repository (subversion)
 * Report issues
 * Full software baseline
 * Just the jar file
 * Simple test app and user admin interface

Architecture
The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need.

http://www.owasp.org/images/d/de/OWASP_ESAPI_Architecture.png

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP Top Ten. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://www.owasp.org/images/e/e6/OWASP_ESAPI_Top_Ten.png

There are two key parts to the ESAPI:
 * A set of interfaces
 * A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

Documentation
Lots more information in the PowerPoint presentation contained in the documentation folder in the full release zip file.

There is also quite a bit of information in the javadoc documentation for the project, and the installation and build guide.

Project Sponsors
The OWASP Top Ten project is sponsored by https://www.owasp.org/images/d/d1/Aspect_logo.gif