2

I am doing research for a post-graduate project. It generally involves security and distributed server network. Project will aim for speed, scalability and safety and I am looking for a framework to create web service(s) running on each node.

There are 4 main requirements for that framework with which I want to build proof of concept:

  • it must be fast - idea is that it has to be efficient and while I aim for scalability, I don't want to add another server just because 50 requests per second freezes the whole server,
  • it must work with JVM - I got some experience with Java SE, Spring Framework, Clojure, Groovy and I am currently learning Scala. It will be easier to create something solid with Java stack than with e.g. .Net I know nothing about,
  • it must be safe - though I have Computer Security Master at my disposal and whole thing will be reviewed, I know that there will be some security issues with my code I'll have to address, and I don't want to be burdened with too many framework's/container's security problems as well,
  • it should be easy to develop - we already know that development with e.g. Spring can be a pain and a bottleneck unless you know awfully lot about the framework. I heard that Play Framework is much better in this regard but can I consider it safe?

I am not planning to expose any sort of web user interface, so any HTML5, LESS and CMS scaffolding is unimportant. API will be made with client applications in mind.

Besides that could you recommend some books/articles about developing secure code with Java? At some point I learnt that e.g. you cannot store sensitive data within String and I found some nice articles at the internet but I'm sure there will be a lot of other important pieces of information required to create secure Java code.

  • Welcome to Software Recommendations! I work in the field of productive Java Enterprise systems and know many (but not all) systems that would be fast&secure but they have a hard learning curve (Spring is one of the easier ones). You might consider dropping that one point. Also how secure do you want this to be? Security is usually defined by what attacks you want to prevent and if storing data in Spring is a problem then storing it in memory is the actual problem and it will be tricky not to do that. – Angelo Fuchs Feb 5 '15 at 9:41
  • Thanks for reply! Hard learning curve requirement can be dropped - it's just that I'm against running heavy CMS oriented framework, where all I want is text/binary service. As for security - I meant something that prevent e.g. SQL injections, won't add to header information that I didn't order it to, won't handle requests that I haven't explicitly routed, let me sanitize input easily, and won't perform too much magic - RoR for instance do a lot of things magically and one have to be really careful not to expose some sensitive data to the attacker. I want to know exactly what my server does. – Mateusz Kubuszok Feb 5 '15 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.