Securing JSF Applications Against the OWASP Top Ten
Securing MyFaces Applications Against the OWASP Top Ten