Secure software development
Secure Hashing Web Service
I refactored a Spring Boot web service to strengthen data integrity, encrypted communication, certificate management, and dependency security. The finished service generates SHA-256 checksums through an HTTPS endpoint and uses repeatable security testing to evaluate its supporting libraries.
- Java
- Spring Boot
- SHA-256
- HTTPS
- SSL/TLS
- OWASP Dependency-Check
Defense in depth
Hashing, encrypted transport, certificate management, and dependency analysis work together to reduce risk across the service.
Overview
Strengthening an existing service without changing its purpose
The project focused on secure refactoring. I preserved the application's core behavior while improving how it protects data, communicates over the network, manages cryptographic material, and evaluates third-party components.
Security objective
Confidentiality, integrity, and resilience
The solution combines a strong hashing algorithm, protected communication, secure key storage, and vulnerability analysis to address several layers of application security.
Security architecture
Four complementary protection layers
Data integrity
SHA-256 creates a fixed 256-bit digest for submitted data, making unexpected changes easy to detect.
Encrypted transport
HTTPS and SSL/TLS protect application traffic while it travels between the client and the service.
Certificate management
A Java keystore stores the certificate and private-key material used to enable the secured endpoint.
Dependency analysis
OWASP Dependency-Check identifies known risks in third-party libraries and supports repeatable security reviews.
Implementation process
Refactor, configure, scan, and verify
Reviewed the existing Spring Boot service and identified security requirements
Added a SHA-256 hashing routine with Java MessageDigest
Created and configured a Java keystore for SSL/TLS communication
Moved the service to an HTTPS endpoint
Ran OWASP Dependency-Check against the project dependencies
Repeated functional and dependency testing after the security changes
Testing & validation
Verifying security and functionality together
Hash verification
Confirmed that the endpoint consistently returned a SHA-256 checksum for the supplied input.
Secure communication
Verified that the application could run through its configured HTTPS endpoint.
Regression testing
Re-executed the refactored application to confirm that the security changes preserved its original behavior.
Dependency review
Compared repeated OWASP reports to confirm that the refactoring introduced no additional dependency findings.
Security testing evidence
Dependency analysis before and after refactoring
The reports document the dependency baseline and follow-up scan. Only project-level testing information is shown; personal, certificate, browser, and environment details have been excluded.
Initial dependency scan
The first OWASP Dependency-Check report established a baseline for known third-party dependency findings.
Follow-up dependency scan
A second scan verified that the secure refactoring did not introduce additional dependency findings.
Secure coding practices
Building security into the development process
- Use current, well-supported cryptographic algorithms
- Protect data in transit with authenticated encryption
- Store key material in a dedicated keystore
- Validate input before processing it
- Handle errors without exposing implementation details
- Apply least-privilege access in production environments
Cryptographic reasoning
Choosing algorithms for distinct responsibilities
SHA-256 supports integrity by producing a deterministic digital fingerprint, while AES-256 is appropriate when confidentiality requires reversible encryption. Secure random values, protected key exchange, and careful keystore management are equally important because a strong algorithm alone does not secure the complete system.
Project outcome
A more secure service supported by repeatable evidence
The completed project demonstrates my ability to apply cryptographic controls, configure encrypted communication, manage certificates, review third-party risk, and verify that security improvements preserve application functionality.