Secure Coding in Java with Claude Code

Day 1

Coding responsibly with Claude Code

What is security?

Threat and risk

Cyber security threat types – the CIA triad

Consequences of insecure software

What is responsible AI?

Security and responsible AI in software development

The OWASP Top Ten from Claude Code's perspective

The OWASP Top Ten 2025

A01 - Broken Access Control 

· Access control basics

· Case study – Broken authn/authz in Apache OFBiz

· Confused deputy 

o Insecure direct object reference (IDOR)

o Path traversal

o Case study – RCE via path traversal in Apache OFBiz

o Lab – Insecure Direct Object Reference

o Path traversal best practices

o Lab – Experimenting with path traversal in Claude Code

o Authorization bypass through user-controlled keys

o Case study – Remote takeover of Nexx garage doors and alarms

o Lab – Horizontal authorization

· File upload 

o Unrestricted file upload

o Good practices

o Lab – Unrestricted file upload

o Case study – File upload vulnerability in Netflix Genie

· Server-side Request Forgery (SSRF)

o Case study – SSRF in Ivanti Connect Secure

A02 - Security Misconfiguration 

· Configuration principles

· Web security configuration issues

o Content Security Policy

o Fetch directives

o Source allowlisting

o Strict CSP: using nonces and hashes

o CSP best practices

· Cookie security

o Cookie attributes

· Secrets management

o Hard coded passwords

o Best practices

o Lab – Hardcoded password

· XML entities 

o DTD and the entities

o Entity expansion

o External Entity Attack (XXE)

- File inclusion with external entities

- Server-Side Request Forgery with external entities

- Lab – External entity attack

- Preventing XXE

- Lab – Prohibiting DTD

- Case study – XXE vulnerability in Ivanti products

- Lab – Experimenting with XXE in Claude Code

Day 2

The OWASP Top Ten from Claude Code's perspective
A03 - Software Supply Chain Failures 
•    Using vulnerable components
•    Assessing the environment
•    Hardening
•    Untrusted functionality import
•    Supply chain security and the Software Bill of Materials (SBOM)
•    SBOM examples
•    Case study – The Polyfill.io supply chain attack
•    Vulnerability management
o    Patch management
o    Vulnerability management
o    Vulnerability databases
o    Lab – Finding vulnerabilities in third-party components
o    DevOps, the CI / CD build process and Software Composition Analysis
o    Dependency checking in Java
o    Lab – Detecting vulnerable components
•    Security of AI generated code
o    Practical attacks against code generation tools
o    Dependency hallucination via generative AI
o    Case study – Agentic coding and code security (mid-2025 onward)
A05 - Injection
•    Input validation
o    Input validation principles
o    Denylists and allowlists
o    What to validate – the attack surface
o    Where to validate – defense in depth
o    When to validate – validation vs transformations
o    Output sanitization
o    Encoding challenges
o    Unicode challenges
•    SQL injection 
o    SQL injection basics
o    Lab – SQL injection
o    Attack techniques
o    Content-based blind SQL injection
o    Time-based blind SQL injection
o    SQL injection best practices
-    Input validation
-    Parameterized queries
-    Lab – Using prepared statements
-    Case study – SQL injection in Fortra FileCatalyst
•    Code injection 
o    OS command injection
-    Lab – Command injection
-    OS command injection best practices
-    Using Runtime.exec()
-    Lab – Command injection best practices
-    Case study – Shellshock
-    Lab - Shellshock
-    Case study – Command injection in VMware Aria
•    HTML injection - Cross-site scripting (XSS) 
o    Cross-site scripting basics
o    Cross-site scripting types
-    Persistent cross-site scripting
-    Reflected cross-site scripting
-    Client-side (DOM-based) cross-site scripting
o    Lab – Stored XSS
o    Lab – Reflected XSS
o    XSS protection best practices
-    Protection principles - escaping
-    Lab – XSS fix / stored
-    Lab – XSS fix / reflected
-    Case study – XSS vulnerabilities in DrayTek Vigor routers
Day 3
The OWASP Top Ten from Claude Code's perspective
A06 - Insecure Design 
•    The STRIDE model of threats
•    Secure design principles of Saltzer and Schroeder 
o    Economy of mechanism
o    Fail-safe defaults
o    Complete mediation
o    Open design
o    Separation of privilege
o    Least privilege
o    Least common mechanism
o    Psychological acceptability
•    Client-side security 
o    Frame sandboxing 
-    Cross-Frame Scripting (XFS) attacks
-    Lab – Clickjacking
-    Clickjacking protection best practices
-    Lab – Using CSP to prevent clickjacking
A07 - Authentication Failures 
•    Authentication 
o    Authentication basics
o    Multi-factor authentication (MFA)
o    Case study – The InfinityGauntlet attack
•    Password management 
o    Storing account passwords
o    Password in transit
o    Lab – Is just hashing passwords enough?
o    Dictionary attacks and brute forcing
o    Salting
o    Adaptive hash functions for password storage
o    Lab – Using adaptive hash functions in JCA
o    Lab – Experimenting with adaptive hash functions in Claude Code
•    Password policy
o    NIST authenticator requirements for memorized secrets
o    Password database migration
A08 - Software and Data Integrity Failures 
•    Subresource integrity 
o    Importing JavaScript
o    Lab – Importing JavaScript
o    Case study – The British Airways data breach
•    Insecure deserialization 
o    Serialization and deserialization challenges
o    Integrity – deserializing untrusted streams
o    Integrity – deserialization best practices
o    Look ahead deserialization
o    Property Oriented Programming (POP)
-    Creating a POP payload
-    Lab – Creating a POP payload
-    Lab – Using the POP payload
-    Case study – Deserialization RCEs in NextGen Mirth Connect
A10 - Mishandling of Exceptional Conditions 
•    Error and exception handling principles
•    Error handling
o    Returning a misleading status code
o    Reachable assertion
o    Information exposure through error reporting
-    Information leakage via error pages
-    Case study – Information leakage via errors in Apache Superset
•    Exception handling
o    In the catch block. And now what?
o    Catching NullPointerException
o    Empty catch block
o    Lab – Exception handling mess
Wrap up 
Secure coding principles
•    Principles of robust programming by Matt Bishop
And now what?
•    Software security sources and further reading
•    Java resources
•    Generative AI – Resources and additional guidance.