SRV.11.1 Introduction

A web application contains many resources that can be accessed by many users. Sensitive information often traverses unprotected open networks, such as the Internet. In such an environment, there is a substantial number of web applications that have some level of security requirements. Most servlet containers have the specific mechanisms and infrastructure to meet these requirements. Although the quality assurances and implementation details may vary, all of these mechanisms share some of the following characteristics:

• Authentication: The mechanism by which communicating entities prove to one another that they are acting on behalf of specific identities.

• Access control for resources: The mechanism by which interactions with resources are limited to collections of users or programs for the purpose of enforcing availability, integrity, or confidentiality.

• Data integrity: The mechanism used to prove that information could not have been modified by a third party while in transit.

• Confidentiality or data privacy: The mechanism used to ensure that the information is made available only to users who are authorized to access it and is not compromised during transmission.