intershop engineered

How to build Microservices with Intershop

Intershop’s Microservices Everybody talks about microservices. Since e-Commerce systems are complex and consist of many components, microservices as self-contained, largely decoupled units integrate perfectly into Intershop’s e-Commerce systems. Intershop products, like Intershop Commerce Management, are build using strictly service oriented and

OWASP Top Ten Project 2013 No 1 – Injection

To avoid SQL injection vulnerabilities only prepared statements with parameter binding should be used: String custname = request.getParameter(“customerName”); String query = “SELECT account_balance FROM user_data WHERE user_name = ?”; PreparedStatement pstmt = connection.prepareStatement(query); pstmt.setString(1, custname); ResultSet results = pstmt.executeQuery(); Intershop

OWASP Top Ten Project 2013 No 2 – Broken Authentication and Session Management

For additional information please refer to Overview – Administration and Configuration and its subsequent documents. User Credentials & Passwords By default Intershop used to have a cryptographic one-way hash function (MD5) to encrypt the users password. As MD5 is known

OWASP Top Ten Project 2013 No 3 – Cross-Site Scripting (XSS)

As the base for XSS vulnerability is the non-encoded integration of untrusted input into dynamically created web pages, it is necessary to make sure that any input is encoded when being displayed. With Intershop Commerce Management (ICM) this is being

OWASP Top Ten Project 2013 No 4 – Insecure Direct Object References

Indirect Object References Sensitive parameters in URLs should be encrypted or processed in a way that the range of possible values is much larger than the range of really used values. The probability to guess a valid value would drop

OWASP Top Ten Project 2013 No 5 – Security Misconfiguration