Difference between revisions of "Scala Frameworks"

From OWASP
Jump to: navigation, search
Line 26: Line 26:
 
|}
 
|}
  
== Sensitive information in Configuration Files==
+
==Play Framework==
 +
=== Sensitive information in Configuration Files===
 
Every Scala project will contain configuration files that can contain sensitive information such as:
 
Every Scala project will contain configuration files that can contain sensitive information such as:
 
* Passwords in clear text
 
* Passwords in clear text

Revision as of 01:42, 7 November 2017

Scala language , just as JAVA , offers different types of Security Frameworks you can work with. Depending on the task, here we offer some general guidelines regarding the proper use of them The following table contains the most popular ones and their security in terms of modules and implementation

Security Frameworks

The following Scala frameworks contain modules that help developers implement secure features such as Authentenciation, Authorization, CRSF or SQLInjection

Framework Authentication Authorization CSRF XSS SQLInjection
Play - - -
Deadbolt 2 - - -
Play-pac4j - - - -
Scala-oauth2-provider - - - -
SecureSocial - - - -
Silhouette - Play Framework Library - - - -
Lift
Akka (Akka-http) - - -
Spray - - -

Play Framework

Sensitive information in Configuration Files

Every Scala project will contain configuration files that can contain sensitive information such as:

  • Passwords in clear text
  • Path to Keystores
  • Passwords from Keystores

Programers should avoid configuring clear text passwords in Application.conf files, for that purpose, encryption is necessary

Configuration Keystore

At some point, especially for projects requiring secure communications (HTTPS), the implementation and use of Keystore is required. The Playframework provides some examples of implementing this unfortunately, there is no further information on how to create this information securely. The developer must also keep in mind that the default configuration is quite insecure and certificates generated are self-signed, becoming unsuitable for real applications.

play.server.https.keyStore.path - The path to the keystore containing the private key and certificate, if not provided generates a keystore for you

Security issue: Keys must be secure guarded, allowing the 'generated' one, can allow an attacker obtain such information if code is compromised

play.server.https.keyStore.password - The password, defaults to a blank password

Security issue: Blank passwords are a 'no-go', therefore, it is essential to change this information. Again, do not create a 'clear-text' passwords, but make sure you use an environment variable for this purpose, or encrypt properly if you place one in the configuration file

play.server.https.keyStore.algorithm - The key store algorithm, defaults to the platforms default algorithm

Security issue: Developer should check what is the 'defaults' being used and make sure the algorithm in question is secure as recommended by NIST guidelines

Encryption Keystore

Vulnerable Framework Components

It is essential that developers implement regular dependency checks of their components, since must Scala projects will make use of the above mentioned frameworks

Reference

https://www.47deg.com/blog/security-frameworks-for-scala/