GRCLibrary.ai

Standard

Jakarta EE Application Security Standard

This standard defines the security controls for server-side Java applications that the organization builds on the Jakarta EE platform, or on its predecessor Java EE where still in service. It covers the platform's own security features (authentication mechanisms, identity stores, declarative and programmatic authorization, the authentication and authorization service-provider interfaces) and the servlet-layer concerns that sit around them: sessions, cookies, transport, container configuration, injection, error handling, logging, and patching.

Type
Standard
Version
0.0.6
Date
2026-10-01
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Developer Security
Review frequency
Annual and upon a new Jakarta EE platform release or material change to the application-server estate
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Platform alignment
  • 4. Authentication mechanisms
  • 5. Identity stores
  • 6. OpenID Connect client
  • 7. Authorization and role mapping
  • 8. Jakarta Authentication modules
  • 9. Transport security
  • 10. Sessions and cookies
  • 11. Container defaults to harden
  • 12. Injection in persistence, expression language, and dependency-injection contexts
  • 13. Error handling and information disclosure
  • 14. Logging
  • 15. Dependency and container patching
  • 16. Verification
  • 17. Operating expectations
  • 18. Framework alignment
  • 19. Limitations

Frameworks it maps to

Related documents