Is there a Java web infrastructure that uses the Java security manager for minor protection?

Question

In the standard webapp setting, all code works with the same privileges. It would be desirable to follow the principle of least privilege , and the Java security manager ("sandbox") should theoretically make this possible.

I assume that the parameter in which the code in the webapp consists of a "front end", whose code has the privilege to perform only those actions that are allowed to the user, and an "end" that is executed with great privileges and imposes these restrictions on the code "front end". Then the templates and most of the control logic will be part of the less privileged "front-end" code, limiting the attacker's ability to compromise security.

Is it already done? Is this part of any widely used web structure already?

Answer 1

I think the Kohsuke Stapler framework uses (or can use) the Java Security Manager, but I cannot find a link for this at the moment. The Stapler frame is large (it is mainly used by Hudson / Jenkins), but the documentation for it is extremely incomplete.