i have asked to do a web application using java (using open source frameworks) which should be a high secured application.
I have an impression that using https will solve all the issues related to communication between browser and server. is it correct ?
if i want to store the login details in to the session object. is it really safe if i do that assuming the connection is https.
please give me some thoughts about how to develop secured(to sustain session ID spoofing etc..) applications using java. all the while i was just doing normal username and password login applications where the system stores user info(like username and role) into session object.
Thanks & Regards,
Venky
Kindly read OWASP Guide before start developing secured web application.