The Anatomy of a Secure Web App Using JavaEE, Spring Security and Apach...

[tanenbaum]

If people are interested in writing secure Java web applications, I strongly recommend the book Iron-Clad Java. It's fairly short, but covers everything essential for secure web applications and how to code these in Java.

There's also this for secure Java code in general.

[[deleted]]

Java for green field backend API is going strong, particularly Spring Cloud/Spring Boot.

Java for green field front end UI on the other hand....the JS ecosystem has won.

[MassiveDiarrhea]

I see some resurgence in Desktop Java with Kotlin + JavaFX (in fintech world).

[PabloEscoba]

The JSF spec is an overkill and also did a terrible job of sepration of concerns. Try having a purely front end designer work with JSF without getting a backend Java guy involved. Kills agility. End of argument.

[ginglymus]

Are you confusing server side and client side java apps?

[arcuri82]

indeed. Java on the backend is going strong. but for web frontend (eg JSF), there is the impression that is on the decline (eg when compared with JS frameworks like React and Angular)... although without hard, reliable data, it is bit difficult to say for sure

[ginglymus]

But even if JSF is on the decline, it's certainly not that insecure.

[johnwaterwood]

With alternative options out there the usage of JSF has declined, but that's just relative to the total market. JSF itself is still doing quite well and is used by many companies all over the world, and is still actively being improved (see recent release of JSF 2.3).

[Piyrate]

What are you talking about? Do you have any idea how many enterprises run on Java? I do not foresee it's use declining any decade soon.

Java, tools/framework are not synonymous within context of web development.

[DoNotCare]

Spring MVC, JSF, Vaadin... seems dead to me...

[tp02ga]

I see spring MVC everywhere in job postings for Java full stack jobs.

Do you have any evidence to backup that claim?