Does Knox have protection against other web app vulnerabilities like injection, broken authentication, etc.?

[#1]

Security dept. is asking about the Knox REST API and the protections that are built into the service.

[#2 · Accepted solution]

The answer is going to depend on exactly what you are looking for.

Knox has a general purpose WebAppSercurityProvider that currently supports layering Cross Site Request Forgery (CSRF) protection onto any of the REST APIs Knox currently supports. The WebAppSecurityProvider is also extensible to so that support for other common WebApp vulnerabilities could be developed and plugged in.

Knox does not currently have any support for layering injection vulnerability protection to the supported REST APIs. This is possible for some services given the architecture but would require a much tighter coupling between Knox and those services than would be ideal.

Can you please clarify what you mean by "broken authentication" before I tackle that one?