spring-projects/spring-boot — pull request #1225 by gillarramendi (2014-07-09 10:05:05+00:00)
Title: Adding support for Hdiv Security

This adds a starter and autoconfigure support for [Hdiv Security](https://github.com/hdiv/hdiv).

HDIV adds an interaction security layer to avoid or mitigate the exploitation attempts of an important part of OWASP top ten web risks (A1, A3, A4, A7, A8, A9, A10).

Basically the functionalities offered by HDIV are:

- Integrity of non editable data: HDIV avoids the manipulation of links (URL & parameters), forms (parameters , URL), cookies, etc. all the information excepting text fields and http headers.
Also HDIV only allows the parameters included in the original form and URL avoiding the exploitation of common vulnerabilities or custom security issues sending unexpected parameters.

- Generic validation on text fields: HDIV implements a generic validation system that applies whitelist and blacklist validation to the whole application (only to data that come from text fields).
If HDIV detects any validation error, the error is presented within the form as an usual error.

- Adds Aleatory tokens to avoid CSRF: this is the only overlap with Spring Security. In the case of HDIV activation Spring Security CSRF feature is deactivated and is used the HDIV implementation for that.

- Confidentiality: HDIV hides (is configurable) the real values of the parameters included within forms and links, assuring the confidentiality of critical information and database ids.