312-96: Certified Application Security Engineer (Java)

A trust boundary denotes a transition between trust zones or privilege levels in a data-flow diagram. It is represented by a dashed boundary line, which is component 1.

Directory browsing should be disabled to prevent unauthenticated users from enumerating directory contents and file names. The servlet DefaultServlet uses the listings initialization parameter; a value of false prevents directory listings from being displayed.

migrateSession protects against session fixation by creating a new session upon authentication and copying the existing session attributes to that new session. The pre-authentication session identifier is therefore not retained as the authenticated session.

The Connector attribute maxPostSize specifies the maximum POST request-body size Tomcat will process for request parameters, including applicable multipart/form-data uploads. Setting it to the desired size establishes that limit. Apache Tomcat HTTP Connector configuration

Security use cases are derived from abuse cases to describe the protective behavior and security controls required to prevent, detect, or mitigate abusive system interactions.