Develop Secure Java Applications to Prevent Website Attacks

 Technical proofed/reviewed:

https://www.manning.com/bundles/develop-secure-java-applications-to-prevent-website-attacks

Solution to double partition Alphametics

“Solution to double partition Alphametics”, Knuth Donald, The Art of Computer Programming, Pre-Fascicle 2b, Generating All Permutations, Addison-Wesley, 12 June 2004, p. 42. http://www-cs-faculty.stanford.edu/~knuth/taocp.html#vol4

Bcrypt Spring Security

From https://github.com/devwebcl/spring-samples

This simple sample to hash password using blowfish2a compatible with Postgres pgcrypto https://www.postgresql.org/docs/9.3/static/pgcrypto.html

It uses sample from http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/crypto/bcrypt/BCrypt.html

update: https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCrypt.html

 

 

Apócope

En gramática, una apócope (del griego apokopé < apokopto, "cortar") es un metaplasmo donde se produce la pérdida o desaparición de uno o varios fonemas o sílabas al final de algunas palabras. Cuando la pérdida se produce al principio de la palabra se denomina aféresis, y si la pérdida tiene lugar en medio de la palabra se llama síncopa. Es una figura de dicción según la preceptiva tradicional. 

 

https://es.wikipedia.org/wiki/Ap%C3%B3cope

Swagger to PDF/HTML5

     Pasos swagger:


    We need to have installed the following tools: swagger2markup and asciidoctor

• brew install asciidoctor
• brew install swagger2markup-cli    

1.     get swagger.json with springboot up&running:
       http://127.0.0.1:8080/v2/api-docs
2.     copy swagger.json
3.     mkdir adocs
4.     swagger2markup convert -i swagger.json -d adocs
5.     modify overview.adoc (title =)
6.     asciidoctor index.adoc
7.     asciidoctor-pdf index.adoc

    $  cat index.adoc
    :doctype: book
    :toc: left
    :toclevels: 3
    :numbered:
    :hardbreaks:
    :sectlinks:
    :sectanchors:

    include::./overview.adoc[]
    include::./paths.adoc[]
    include::./security.adoc[]
    include::./definitions.adoc[]

ICMP - Internet Control Message Protocol

https://stackoverflow.com/questions/21981796/cannot-ping-aws-ec2-instance

Add a new EC2 security group inbound rule:

• Type: Custom ICMP rule
• Protocol: Echo Request
• Port: N/A
• Source: your choice (I would select Anywhere to be able to ping from any machine)

The related ping utility is implemented using the ICMP echo request and echo reply messages. 

 

https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

Function: Send ICMP ECHO_REQUEST to network hosts

Syntax: ping [-aAbBdDfhLnOqrRUvV6] [-c count] [-F...

 

Create an Open Banking App Using OpenAPIs and Spring Boot

Technical proofed/reviewed:

 

https://www.manning.com/liveproject/create-an-open-banking-app-using-openapis-and-spring-boot

Good Java interface design

1.  AutoCloseable
2.  JpaRepository, CrudRepository and PagingAndSortingRepository.
   

Java Copy Constructor

Sometimes we need to clone an object in Java, but not a reference (a junior developer may use). There are several ways to achieve this task; however, I recommend to use a copy-constructor (that comes from C++) and, in particular, using @Builder from Lombok (to avoid boilerplate code))

 

curl cheat sheet

 Curl, the wget with steroids. https://curl.se/

1. response headers

curl -I http://localhost:8081/customers

HTTP/1.1 302
Set-Cookie: KC_REDIRECT=/customers; Path=/; HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Location: http://localhost:8081/sso/login
Transfer-Encoding: chunked
Date: Sun, 27 Dec 2020 15:38:57 GMT

2.  gzip call

curl -v -H "Content-Type: application/json" -H "Accept-Encoding: gzip" -I http://127.0.0.1:8080/example/fourkb 

Content-Encoding: gzip
Content-Type: application/json

curl -v -H "Content-Type: application/json" -H "Accept-Encoding: gzip" http://127.0.0.1:8080/fourkb -o four.json.gz

curl -v --compressed
-verbose

3.  curl get

curl -k --max-time 30 -X GET 'https://10.10.10.31:8080/rest/accounts?user=test&password=test&channel=1&client-ID=1020'
 --request GET
 
 
4. curl post body:

curl -k --request POST 'https://10.10.10.31:8080/rest/num-accounts' --header 'Content-Type: application/json' --data-raw '{"user":{"user":"testuser","password":"welcome1","request-channel":1},"client-ID":"12345"}'

-d '{"query":{"match_all":{}}}'
-d, --data <data>


5. ssl

to avoid self-signed cert:

-k

curl --cacert cacert.pem https://self-signed.badssl.com


6. cookie

--cookie "jsessionid=123"

7. timeout

--max-time 30


8. header

curl -H "Authorization: Basic YXBpdXNlcjphcGlwd2Q=" http://devweb.cl/status


9.  basic user?

--basic --user "redemption-br:GUkboMIZ"

 
10. for brackets

curl -g

otherwise:
curl: (3) bad range in URL position 47:

11. download

-O -J

curl -k -O -J https://www.devweb.cl/file.txt

 
12. linux/windows

linux:

curl -X POST http://172.18.235.19:8773/api/v1/publishEvent --header 'Content-Type: application/json' --data-raw '{"user":{"user":"testuser","team":"welcome1","request-channel":1},"client-ID":"12345"}'


windows:

curl -X POST http://127.0.0.1:8773/api/v1/publishEvent --header "Content-Type: application/json" --data-raw  "{\"user\":{\"user\":\"testuser\",\"team\":\"welcome1\",\"request-channel\":1},\"client-ID\":\"12345\"}"