  Java platform and third-party libraries provide various security features to
facilitate secure coding. However, misusing these features can cost tremendous
time and effort of developers or cause security vulnerabilities in software.
Prior research was focused on the misuse of cryptography and SSL APIs, but did
not explore the key fundamental research question: what are the biggest
challenges and vulnerabilities in secure coding practices? In this paper, we
conducted a comprehensive empirical study on StackOverflow posts to understand
developers' concerns on Java secure coding, their programming obstacles, and
potential vulnerabilities in their code. We observed that developers have
shifted their effort to the usage of authentication and authorization features
provided by Spring security--a third-party framework designed to secure
enterprise applications. Multiple programming challenges are related to APIs or
libraries, including the complicated cross-language data handling of
cryptography APIs, and the complex Java-based or XML-based approaches to
configure Spring security. More interestingly, we identified security
vulnerabilities in the suggested code of accepted answers. The vulnerabilities
included using insecure hash functions such as MD5, breaking SSL/TLS security
through bypassing certificate validation, and insecurely disabling the default
protection against Cross Site Request Forgery (CSRF) attacks. Our findings
reveal the insufficiency of secure coding assistance and education, and the gap
between security theory and coding practices.
