5. Spring Security Authorization @Controller @Secured(Roles.ROLE_ADMINISTRATOR) @RequestMapping(UserController.BASE_URL) public class UserController extends BaseController {
6. Spring Security Cross Site Request Forgery Token
7. Spring Security Good practices headers
8. Step 2 Passwords
9. Passwords Store it using a strong salted hash Bcrypt Never send it by e-mail or store it in plain text Protect user creation/password recovery forms with captcha Recaptcha when possible JCaptcha second choice
10. Step 3 SQL Injection
11. SQL Injection Always use SQL Parameters: @SqlUpdate("UPDATE User ug " + " SET DsEmail = :dsEmail" + " WHERE idUser = :idUser")
12. Step 4 Use JSTL carefully
13. JSTL Wrong: Correct: Why? />/ > c:out escapes the string with html entities like <
