Security on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

Fri, 23 Oct 2026 00:00:00 +0000

pac4j is an open-source Java security library for authentication and authorization. It supports protocols such as OpenID Connect, OAuth 2.0, SAML and CAS, with integrations for multiple Java web frameworks. I am Jérôme LELEU, the maintainer of pac4j. In this tutorial, we will use its OpenID Connect client with Spring Boot.

You want users to sign in to your Java application with Keycloak, Google, Microsoft Entra ID, Okta, Auth0 or even a CAS server. They already have an account there, so your application should not ask them for another password.

OWASP Java Security Libraries: Please Update!

Fri, 23 Oct 2026 00:00:00 +0000

Hello Foojay!

I’ve been working hard on bringing two Java security libraries up to date: OWASP Java Encoder and OWASP Java HTML Sanitizer. These libraries are still used in a lot of applications and security products around the world. Both have fresh releases, and I’d love to get more Java developers looking at them again.

My request is pretty simple: please update if you use these! And if they matter to your application, I’d love your feedback.

Scraping websites and bot-protection

Thu, 15 Oct 2026 00:00:00 +0000

While searching for my ancestors, I had to access data from many different websites. I noticed there were different levels of protection against automated access depending on the site. In this post, I’ll list them and mention countermeasures you can take to bypass them anyway.

Warning: As a private person using the data for my own personal use, I have no qualms about bypassing the protection. It can be considered fair use. However, I don’t know about your context, and I’m not saying you should. Scrape responsibly.

Keep WordPress If You're Looking for Trouble... Or Read This!

Sat, 10 Oct 2026 00:00:00 +0000

I wrote this article by hand. AI was used to review grammar, style, and fact-check the data.

WordPress made it easy for anyone to build a website. So easy that 43% of the web runs on it. Twenty years later, it’s just as easy for anyone to break into one. If that sounds dramatic, keep reading. You can also listen to our podcast on the topic.

11K plugin vulnerabilities in 2025/26 (+42% YoY), exploit time on critical vulnerabilities: 5 hours (source). The question is not if they can pwn your website, it is when.

Introducing cbGenesis: The AI-Native ColdBox Starter for BoxLang

Fri, 09 Oct 2026 00:00:00 +0000

Ortus Solutions today announces the general availability of cbGenesis 1.0, a production-ready ColdBox HMVC starter template for BoxLang, and the first one designed from day one to be built with an AI coding agent, not just by one.

For twenty years, ColdBox has been one of the most battle-tested HMVC frameworks in the CFML and BoxLang world. cbGenesis takes that foundation and ships the part every team rebuilds by hand: authentication, permissions, security hardening, an admin panel, tests, and the guidance an AI agent needs to extend all of it correctly.

Foojay Podcast #102: Why Foojay Walked Away From WordPress for Static Sites

Mon, 05 Oct 2026 00:00:00 +0000

Foojay.io quietly moved off WordPress and onto Hugo, a static site generator. No more CMS login, no database, no admin panel — just Markdown and AsciiDoc files, built and deployed straight from GitHub. In this episode we dig into why that move happened, and into the bigger question behind it: is a traditional CMS still the right way to run a content site in 2026, or has static tooling caught up? Along the way we go through the real security numbers behind WordPress’s plugin ecosystem — more than 10,000 vulnerabilities found in WordPress plugins since 2025 alone — and put very different static site generators head to head: Hugo and Jekyll, the veterans, versus Roq, the Java-and-Quarkus-based newcomer.

How much will post-quantum migration cost your Java codebase?

Mon, 28 Sep 2026 00:00:00 +0000

The post-quantum transition has stopped being a research topic and become a set of dates. NIST finalized ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in August 2024. NIST IR 8547 deprecates RSA, ECDSA, (EC)DH and the rest after 2030 and disallows them after 2035, and similar timelines are turning up in government guidance elsewhere.

So the destination is settled. For most Java teams the hard question is not what to migrate to. It is how much the migration will cost for their specific codebase, and where the expensive parts are hiding. That question has been oddly hard to answer, and most of the post-quantum migration tooling I could find targets C, C++ and Rust, even though a great deal of enterprise cryptography runs on the JVM.

BoxLang AI 3.4.0: Gateways, Human-in-the-Loop, and a Full Security Stack

Fri, 25 Sep 2026 00:00:00 +0000

BoxLang AI 3.4.0 is a major release centered on a single theme: trust. AI agents operating in real applications need ways to involve people in consequential decisions and manage potentially untrusted inputs. This release introduces gateways, a restructured Human-in-the-Loop subsystem with durable decisions, layered security controls, batched approvals, normalized provider reasoning, and broader AWS Bedrock support.

The sections below follow the original BoxLang AI 3.4.0 release announcement and preserve all its code examples. For the complete change log, see the BoxLang AI 3.4.0 release history.

Masking a JVM thread dump without breaking the analysis

Wed, 09 Sep 2026 07:32:00 +0000

A few weeks ago I posted on r/java about detecting virtual thread pinning from a plain thread dump. The technical discussion was fine. The comment that stuck with me had nothing to do with pinning: “the problem isn’t taking the dump, it’s that uploading a production dump to a third-party site is against policy”. Not a preference. Policy. And the person saying it was right.

I run ThreadMine, a hosted thread dump analyzer, so that comment describes my own product. This article is about what I built in response: a small open-source CLI that rewrites the dump on your machine before it goes anywhere, in a way that keeps the analysis working. It’s called tm-anon, it’s MIT, and it works with any analyzer, mine included. The interesting part isn’t the tool, it’s the constraint: you can’t just strip everything, because the analyzer needs most of what’s in there.

Solving Gradle metadata and Renovate integration

Wed, 19 Aug 2026 05:53:45 +0000

My current company has settled on using Gradle. It doesn’t make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc.

This week, I worked on improvements to a new project and set up Renovate. Renovate is similar to Dependabot in that it checks for new versions of your dependencies and automatically creates PRs for you. However, I quickly noticed that merges of new dependency versions failed the build. Here’s the full story on why, and how I fixed the issue.

Your AI Assistant Is Choosing Your Dependencies

Tue, 18 Aug 2026 14:01:20 +0000

When I write about bad actors, I sometimes try to imagine where they are and how they work. For this article, it’s clearer than usual because there is some evidence around. You can use your imagination to fill in the gaps.

Imagine there’s a job going in Pyongyang. Long hours, of course, with probably brutal OKRs. The job is creating malicious packages, measured by how many you can publish a week, how many credentials you can steal, etc. The successful candidate will never meet a customer face to face, but they will meet you occasionally via a dependency you add, or one your coding assistant adds for you.

Build Secure AI Chat Applications with BoxLang, RAG, Ollama, and Amazon Bedrock with Dan Card

Thu, 13 Aug 2026 14:52:13 +0000

Build Secure AI Chat Applications with BoxLang, RAG, Ollama, and Amazon Bedrock

AI demos are everywhere. Building an AI-powered feature that can securely work with your documents, databases, and real application data is a very different challenge.

How do you give an AI model access to the right information without exposing sensitive data? Should you use a locally hosted model or a cloud service? How do you move beyond a basic chatbot and build something genuinely useful for your users or organization?

AI Found the Bugs. Who's Patching Your EOL Java Code?

Thu, 23 Jul 2026 15:26:53 +0000

Earlier this year an AI model found a flaw in OpenBSD’s TCP stack that had been sitting there for 27 years. The same scanning run turned up a 16-year-old bug in FFmpeg’s H.264 code.

How do you feel about AI being used to discover bugs in open source, across the board and at scale?

Because that’s what’s happening. It’s tough enough dealing with machine-speed vulnerability discovery in code that has active maintainers. What about all the code with no friendly pair of safe hands?

BoxLang AWS, Azure, and Google Secrets Manager Module Released

Tue, 21 Jul 2026 11:38:18 +0000

Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them – it’s how badly the current approach is going to hurt you.

Hardcoded credentials in config files get committed to repos. Environment variables sprawl across deployment pipelines with no audit trail. Custom integration code for each cloud provider means three different patterns to maintain, test, and rotate. And when a key needs to rotate at 2am? Someone is waking up.

This Dependency Update Looked Exactly Like an Account Takeover

Fri, 03 Jul 2026 08:31:27 +0000

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases carried a GPG signature. This one did not.

If you have read the post-mortems of real supply-chain attacks, that pattern should make you sit up. A package that has signed its releases for years suddenly ships one unsigned. The boring explanation is a build pipeline change. The other explanation is that a different person is publishing now, and the signing key stayed behind with the old one. When ua-parser-js was hijacked in 2021, the malicious versions came from a compromised account. When event-stream went bad in 2018, it was a new maintainer nobody had vetted. The artifact looks fine. The metadata around it is what changed.

7 Jackson CVEs in One Day: AI-Assisted Security Research

Mon, 29 Jun 2026 11:47:41 +0000

Quick version check: the affected range for all seven is broadly >=2.10.0 =2.19.0 =3.0.0 <3.1.4 — with some CVEs affecting narrower ranges. If you’re on a supported release, upgrade to 2.18.8, 2.21.4, or 3.1.4. If you’re on an EOL line — 2.13.x, 2.14.x, 2.15.x — jump to the bottom of the page for more specifics or visit HeroDevs Jackson Support

Not a sales pitch

Anyone who knows me knows I dont do that. In this case I’m pointing you at HeroDevs because the Jackson issues are serious, HeroDevs have a solution thats stupidly easy to use and I know the folks behind the fixes. It takes a particular type of engineer to create security fixes and I know they have that skillset. Do your own research.

Quarkus Unpacked: Insights from the Foojay Podcast

Tue, 23 Jun 2026 12:36:54 +0000

I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from what makes Quarkus different to the practical trade-offs between JVM and native mode. This post captures the key questions and answers from that discussion, lightly edited for readability.

If you have been following this blog series, note that the third installment on building your own stack with Quarkus is coming next. Consider this a bonus entry that distills the podcast conversation into a format you can read, reference, and share.

Did AI Just Break Software Security For Ever?

Tue, 16 Jun 2026 14:51:04 +0000

Whether the answer is yes or no (read on for my opinion) , something fundamental has changed this year. Not one thing. Four things, converging at once.

First: The rate of CVE arrivals

More than 40,000 CVEs were published in 2024, rising to just under 50,000 in 2025. FIRST — the Forum of Incident Response and Security Teams, projects a median of 68,000 for 2026, with realistic scenarios reaching 70,000 to 100,000.

Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"

Fri, 05 Jun 2026 08:52:01 +0000

Back in April I wrote about what happens to your security posture when Spring Boot 3.5 crosses the EOL line.

The short version: the CVE pipeline dries up, your scanner goes quiet, and the bad actors keep watching upstream for anything they can exploit downstream against the dead code nobody’s patching.

I called them zombie dependencies.

June 30th is coming. In a few weeks, Spring Boot 3.5 reaches end of open-source support. You’ve either got a plan or you haven’t.

Tiberius: A Security Testing Framework for LLM Applications in Java

Thu, 04 Jun 2026 20:09:09 +0000

Tiberius: A Security Testing Framework for LLM Applications in Java

How do you write a regression test for a system that is non-deterministic by design?

1. The Problem

Large Language Models have moved from research artifacts to production infrastructure. Java applications are embedding them into customer-facing services via Spring Boot, and e.g. LangChain4J — for document summarization, customer support, healthcare assistance, and financial guidance, to name just a few. The deployment surface is growing faster than the security tooling.

Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang

Tue, 26 May 2026 10:14:00 +0000

JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE encryption, and zero security footguns — is anything but trivial. Today, we’re shipping bx-jwt, a production-ready JWT/JWE module for BoxLang that handles all of it out of the box, so you can focus on building, not fighting cryptography.

bx-jwt is part of the BoxLang+ and BoxLang++ subscription tiers — our enterprise-grade module collection built for teams that take security seriously.

BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity

Tue, 19 May 2026 12:11:19 +0000

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in SystemExecute(), SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Fri, 15 May 2026 15:31:08 +0000

The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first.

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf discovered by pentester Dawid Bakaj. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.

Foojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?

Mon, 11 May 2026 09:57:00 +0000

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs, to dig deep into the state of Java security in 2025 and beyond.

Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.

Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About

Sun, 19 Apr 2026 13:37:13 +0000

Tomorrow I start (o so early) for JCON Europe in Cologne and then, at the tail end of the week, go to Devoxx France to give more talks. If you’re at either, come say hi. Herodevs has a booth at both.

After digging into the CVE stories behind Tomcat 8.5’s end of life, I turned my attention to Spring Boot 3.5. Same question, different framework: what actually happens to your security posture when a project crosses the EOL line?

Why Java Developers Over-Trust AI-Generated Code

Thu, 09 Apr 2026 10:45:36 +0000

This article is adapted from The Confidence Trap, part of the “2026 Supply Chain Reckoning” series on my No Regressions newsletter.

Your boss calls you on a Friday afternoon. He’s read all the available data, he tells you with absolute confidence, and he’s decided that migrating from Spring Boot 3.5 to 4.0 will be straightforward. Wants it done over the weekend.

You’d push back. You’d ask which data. You’d point out the breaking changes.

Best practices for Mastering AI Agents, Subagents, Skills & MCP

Mon, 30 Mar 2026 18:55:59 +0000

A practical guide to the five best practices every developer should apply when working with AI agents, subagents, skills and MCP servers — from choosing the right model and writing precise prompts, to defining agent behaviour with SDD, isolating context with Claude Code subagents, securing MCP calls, and guiding agent response quality with guardrails.

§0 📖 Where This Fits in the Series

This article assumes you already know what MCP is and have used or built at least one Agent.

DPoP: What It Is, How It Works, and Why Bearer Tokens Aren't Enough

Mon, 09 Mar 2026 08:08:06 +0000

DPoP is one of the most exciting developments in the IAM (Identity and Access Management) space in recent years. Yet many backend developers either have not heard of it or are unsure what it actually changes. In this article, I will break down what DPoP is, what problem it solves, and walk through a working implementation with Keycloak and Quarkus.

What is DPoP?

DPoP (Demonstration of Proof-of-Possession) is an OAuth 2.0 security mechanism defined in RFC 9449. Its core purpose is simple: cryptographically bind an access token to the client that requested it. This way, even if a token is intercepted, it cannot be used by another client.

Tomcat TLSv1.3 cipher configuration

Thu, 26 Feb 2026 18:02:34 +0000

A recent update to Apache Tomcat introduced a subtle but significant change to how TLS cipher suites are configured. If your Spring Boot application explicitly configures TLS ciphers, particularly TLSv1.3 ciphers, and runs on Tomcat 9.0.115+ (Spring Boot 2.x), 10.1.52+ (Spring Boot 3.x), or 11.0.18+ (Spring Boot 4.x), your cipher configuration may be silently ignored.

Prior to the change, Tomcat used a single ciphers attribute on the SSL connector to configure cipher suites for all TLS versions. Starting with the versions of Tomcat listed above (Tomcat commit), this attribute was split:

Shai-Hulud and the npm Worm: How Speed-Optimised Dev Ecosystems Made a Self-Propagating Supply Chain Attack Inevitable

Thu, 12 Feb 2026 11:47:48 +0000

first, a word about ecosystems

Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest about something.

The worm didn’t appear in a broken system. It appeared in the one we deliberately optimised.

In the book Dune, the worm is integral to the ecosystem. The planet, its environment, and the worms are deeply interconnected.

That’s true for the cyber-worm equivalent. The worm is an entirely predictable outcome of the ecosystem in which we, as developers, are part