阿帕奇·希罗 &新手 Java 安全
我对 Java 的安全模型几乎一无所知，包括 XML 配置、策略设置、任何安全框架组件、工具（例如密钥库等）以及介于两者之间的所有内容。
尽管我知道它最终将成为我卷起袖子深入学习 Java 安全性的必要，但我想知道使用 Apache Shiro 之类的东西是否有助于简化过渡。因此，我对此有一些担忧。
Shiro 本质上是一个“交钥匙、包罗万象的包装器”，用于在 Java 应用程序（更具体地说是 Web 应用程序）中实现安全性。意思是，人们是否可以使用他们的项目配置 Shiro，并从本质上调整它以执行所有相同的配置、策略设置等，如果没有它，人们就必须“手动”（零碎）进行操作？如果没有，Shiro 有什么缺点（哪些大事 Shiro 不能为我做但又至关重要）？是否存在 Shiro 根本没有解决的重大漏洞？
同样，我也听说过有关 OWASP 的 ESAPI 框架的好消息。有人有这两种经验吗？ ESAPI 和 Shiro 是否可以配置为一起工作，或者只是一个二进制的“一个或另一个”类型的交易？
提前致谢！
I know next-to-nothing about Java's security model, including XML configuration, policy-setting, any security framework components, tools (such as keystore, etc.) and everything in between.
Although I understand it will eventually become essential for me to roll up my sleeves and learn Java security in-depth, I was wondering if using something like Apache Shiro would help ease the transition a bit. As such, I have a few concerns with it.
Is Shiro, essentially, a "turnkey, catchall wrapper" for implementing security in Java applications (and more particularly, web apps). Meaning, can one configure Shiro with their project and essentially tune it do all the same configuration, policy settings, etc. that one would have to do "manually" (piecemeal) without it? If not, what shortcomings does Shiro have (what are some big things Shiro can't do for me that are vital)? Are there any large vulnerabilities that Shiro doesn't address at all?
Along the same lines, I've heard good things about OWASP's ESAPI framework. Aybody have experience with both? Can ESAPI and Shiro be configured to work together or is it simply a binary "one or the other" type deal?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
简短的回答是肯定的。 Shiro 和 ESAPI 都可以一起工作，尽管这两个 API 之间存在大量冗余功能。 Shiro 为您提供了覆盖标准 Java 安全模型所需的一切。 ESAPI 提供了 OWASP 的全球标准化安全机制，超越了这一点。
Shiro 应该由像我这样真正不了解 Java 安全性和/或一般应用程序/服务器安全性的新手使用。它为那些不了解安全的人处理了很多事情。 ESAPI 应该由已经了解 Java 安全性的编程安全专业人士使用，他们不仅希望利用 Java EE 附带的所有功能，还需要加倍努力，让事情变得更加安全。
The short answer is yes. Both Shiro and ESAPI can work together, although there is a lt of redundant functionality between the two APIs. Shiro gives you everything you need for covering the standard Java security model. ESAPI goes above and beyond by providing OWASP's globally-standardized security mechanisms.
Shiro should be used by novices like myself who really don't understand Java security and/or general applications/server security. It takes care of a lot of things for the security-ignorant. ESAPI should be used by programming security professionals that already understand Java security and want to leverage not only everything that comes with Java EE but need to go the extra mile and make things even more secure.