Skip to main content

Posts

Showing posts with the label WEB SECURITY. SECURITY

Java : What is String and why character array is better than String for Storing password.

What is String A Java String contains an immutable sequence of Unicode characters. Unlike C/C++, where string is simply an array of char, A Java String is an object of the class java.lang. Java String is, however, special. Unlike an ordinary class: String is associated with string literal in the form of double-quoted texts such as "Hello, world!". You can assign a string literal directly into a String variable, instead of calling the constructor to create a String instance. The '+' operator is overloaded to concatenate two String operands. '+' does not work on any other objects such as Point and Circle. String is immutable. That is, its content cannot be modified once it is created. For example, the method toUpperCase() constructs and returns a new String instead of modifying the its existing content. What is special in Java to handle characters: Strings receive special treatment in Java, because they are used frequently in a program. Hence, efficiency (in ter...

Web Services : Why HTTPS is required and How SSL/TLS works.

Why is HTTPS required? Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. HTTPS is often used to protect highly confidential online transactions like online banking and online shopping order forms. Web browsers such as Internet Explorer, Firefox and Chrome also display a padlock icon in the address bar to visually indicate that a HTTPS connection is in effect. To verify whether the website is authenticated/certified or not (uncertified websites can do evil things). An authenticated website has a unique personal certificate purchased from one of the CA’s. Who are CA’s (Certificate Authorities)? CA’s are globally trusted companies like GoDaddy, GeoTrust, VeriSign etc who provide digital certificates to the websites. What a...

WebServices : REST is stateless why???

The fundamental explanation is: No client session state on the server. By stateless it means that the server does not store any state about the client session on the server side. The client session is stored on the client. The server is stateless means that every server can service any client at any time, there is no session affinity or sticky sessions. The relevant session information is stored on the client and passed to the server as needed. That does not preclude other services that the web server talks to from maintaining state about business objects such as shopping carts, just not about the client's current application/session state. The client's application state should never be stored on the server, but passed around from the client to every place that needs it. That is where the ST in REST comes from, State Transfer. You transfer the state around instead of having the server store it. This is the only way to scale to millions of concurrent users. If for ...