Real World Example

Area	Check	Where in this course
Authentication	Google/OTP login, MFA for sellers and admins, short-lived tokens with refresh rotation	OAuth2, Custom Authentication
Authorization	deny by default, scopes per API, ownership checks, access-matrix test passing	Resource Server, Testing Security
Brute force	rate limits at edge + app, account lockout, OTP limits	Account Lockout and Rate Limiting
Transport and browser	HTTPS everywhere, HSTS preload, CSP enforced, frame-ancestors none	Security Headers
Services	every service validates JWTs, client credentials between services, no identity headers	Securing Microservices
Secrets	no secrets in Git (gitleaks in CI), secret manager in prod, key rotation plan	Secrets Management
Dependencies	Spring Boot on a supported patch version, Dependabot + OWASP Dependency-Check	OWASP Top 10
Monitoring	login/denial audit logs, alerts on failure spikes, logs masked	Auditing Logins

OWASP Dependency-Check

Dependency scanning in the GitHub Actions pipeline:

./mvnw -q org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=7

Example output

[INFO] Checking for updates and analyzing dependencies for vulnerabilities
[INFO] Analysis Complete (4 seconds)
[WARNING]
One or more dependencies were identified with known vulnerabilities in shopease:
commons-fileupload-1.4.jar (pkg:maven/commons-fileupload/[email protected]) : CVE-2023-24998
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:check: One or more dependencies have CVSS score >= 7.0

Exercise: A tester reports: "GET /api/orders/1077/invoice returns another customer's invoice PDF." Which OWASP category is this, and how do you fix it in ShopEase?

Show answer

Category: A01 Broken Access Control (an IDOR).

Fix in the service, not only in the controller:

@PreAuthorize("hasAuthority('SCOPE_orders.read')")
public byte[] invoice(Long orderId, String callerId, boolean isAdmin) {
    Order order = orders.findById(orderId).orElseThrow(() -> new OrderNotFoundException(orderId));
    if (!isAdmin && !order.getCustomerId().equals(callerId)) {
        throw new OrderNotFoundException(orderId);   // 404, do not reveal that it exists
    }
    return invoiceRenderer.render(order);
}

Then add rows to AccessMatrixTest: another customer -> 404, owner -> 200, admin -> 200.

Where You See This

ShopEase Go-Live Security Checklist

OWASP Dependency-Check