ESAPI and ColdFusion, or 'Security, Authentication and Encoding, oh my!'
In this session, we'll take a look at how to secure enterprise level applications (and anything else in between) using the open source Enterprise Security API (ESAPI) developed by OWASP.
Starting with a look into the simplest implementation of ESAPI's built-in encodeForXXX functions to assist in blocking potential XSS attacks, we'll also delve into the more in-depth authentication protocols, session handling and user access, as well as the access controller to ensure user roles and priviliges are persisted and the correct access to application pages are dealt with.
Also topics to cover (in some detail) are: logging, encryption and encoding.
Although the initial session will mention the original Java version of the ESAPI project, the majority of the session will deal with the ColdFusion version, the CFESAPI project.
