New-age Transactional Systems - Not Your Grandpa's OLTP
John Hugg discusses high volume transaction processing applications with high and low frequency profiles, and how VoltDB can be used for that purpose.
The content has been bookmarked!
There was an error bookmarking this content! Please retry.
Posted by Ryan Slobojan on Sep 14, 2007
HDIV, an open-source web application security framework, recently released version 2.0. InfoQ spoke with HDIV project lead Roberto Velasco Sarasola to learn more about this release.
Sarasola described HDIV as a Java web application security framework which aims to prevent most of the common types of web application vulnerabilities, such as SQL injection, cross-site scripting, and parameter tampering. HDIV assumes that any remote HTTP client request can be an attack vector, and sets about validating that the request is not an attack of some sort - it is meant to address the gaps which exist in the validation strategies of existing frameworks:
Current web frameworks offer some validation functionalities but many times they are not enough to cover common validation needs. For example, if you have a link in your web application such as http://www.myhost.com/action1.do?account=56 to read information about the account number 56, how can you guarantee that a client doesn't update this value to be able to check someone else's account, for example account=40?
With standard security validators (more suitable for editable data validation), it's not possible to check that and you need to create custom validations. For example, including an account id at HttpSession or using user identity in the SQL executed in the database. This security problem, known as instance level security, it's very hard to solve because within a web application there are thousands of similar request that need to be validated.
Sarasola described the capabilities that HDIV provides to combat these sorts of vulnerabilities:
HDIV is integrated into a Java web application through the use of custom JSP tags which are substituted for the normal link and form tags. An HDIV web filter is then inserted into the application's web.xml, and validation is then automatically performed on all requests. In previous versions HDIV supported Struts 1.x and Struts 2.x, however this release now also supports Spring MVC 2.0 and JSTL. Support for these new frameworks was added by extending the Spring and JSTL tags themselves to add in the HDIV functionality - neither the core HDIV libraries nor the web filter required any changes to support them. Also, since Spring and Struts are both action-based frameworks, from HDIV's perspective they are very similar - Sarasola said the biggest challenge has been extending the framework tags themselves because extension points are poorly defined or nonexistent on the tags. He also expressed hope that framework developers would add well-defined extension points to tags to enable other framework developers to integrate with them more easily.
Sarasola was also asked what the future held for HDIV, and he described a plan for webflow integration:
Currently HDIV supports three state management strategies. On the memory and hash strategies HDIV stores an object (state) at the server side for each possible request processed within a JSP (one of each link or form). From a scalability point of view it's interesting to limit the size of the server side cache. In the current release it's possible to define a maximum cache size but many times it's difficult to define an appropriate number because it depends on the application.
We thought about Webflow to solve this problem, because it provides a way to logically divide clients navigation. Thus, HDIV will use webflow listeners capabilities to decide when to delete objects from the cache.
Another interesting feature it's to add automatically the webflow execution key to each link or form using HDIV's custom tags. Now within Struts, Struts 2 and Spring MVC applications we have to add this id manually and we would like to automatize this task.
He also indicated that support for WebWork, Stripes and JSF are planned.
Improve Java Garbage Collection, Runtime Execution, and JVM visibility with Zing
John Hugg discusses high volume transaction processing applications with high and low frequency profiles, and how VoltDB can be used for that purpose.
Kevlin Henney examines code samples to see what can be learned from them starting from the premise that one won’t write great code unless he knows how to read it.
Jason Ayers share the observations he made watching a team of developers collaborating in real time on the same code base, pushing XP, pair programming and continuous integration to their extremes.
Michael Snoyman presents Yesod, a web framework written in Haskell and containing a web server, templating, ORM, libraries (templating, gravatar, etc.).
Richard Kreuter and Kyle Banker on how to avoid classical RDBMS transactional systems by using compensation mechanisms, transactional messaging or transactional procedures.
Attila Szegedi talks about performance tuning Java and Scala programs at Twitter: how to approach GC problems, the importance of asynchronous I/O, when to use MySQL/Cassandra/Redis, and much more.
One category of risk that project teams need to ensure they address is business value failure – delivering a product that fails to provide value for the business investor.
InfoQ spoke to the authors of Software Systems Architecture on a couple of new topics, the System Context viewpoint and Agile, which have been added to the second edition.
No comments
Watch Thread Reply