From: Ryan de Laplante <ryan_at_ijws.com>
Date: Tue, 19 Feb 2008 15:29:07 -0500

The Open Web Application Security Project has a section Java:

http://www.owasp.org/index.php/Category:OWASP_Java_Project


After digging in a bit I found a section for securing popular Java EE
servers:

http://www.owasp.org/index.php/OWASP_Java_Table_of_Contents#J2EE_Security_For_Deployers

Tomcat is there and fully documented. Sun should put a section in there
for GlassFish


Ryan