Secured web application development in java
===

i have asked to do a web application using java (using open source frameworks) which should be a high secured application.

I have an impression that using https will solve all the issues related to communication between browser and server. is it correct ?

if i want to store the login details in to the session object. is it really safe if i do that assuming the connection is https.


please give me some thoughts about how to develop secured applications using java. all the while i was just doing normal username and password login applications where the system stores info into session object.


Thanks & Regards,

Venky
  