Deprecated API

Contents

• Deprecated Classes
• Deprecated Fields
• Deprecated Methods
• Deprecated Constructors

Deprecated Classes

Class and Description
org.owasp.esapi.logging.java.ESAPIErrorJavaLevel 10/24/2020 : References should use ESAPICustomJavaLevel.ERROR_LEVEL
org.owasp.esapi.codecs.LegacyHTMLEntityCodec

Deprecated Fields

Field and Description
org.owasp.esapi.reference.DefaultSecurityConfiguration.ABSOLUTE_TIMEOUT_DURATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ACCEPT_LENIENT_DATES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ACCESS_CONTROL_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ADDITIONAL_ALLOWED_CIPHER_MODES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ALLOW_MIXED_ENCODING Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ALLOW_MULTIPLE_ENCODING Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ALLOWED_LOGIN_ATTEMPTS Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.APPLICATION_NAME Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.APPROVED_EXECUTABLES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.APPROVED_UPLOAD_EXTENSIONS Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.AUTHENTICATION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.CANONICALIZATION_CODECS Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.CHARACTER_ENCODING Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.CIPHER_TRANSFORMATION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.CIPHERTEXT_USE_MAC Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.COMBINED_CIPHER_MODES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_ACCESS_CONTROL_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_AUTHENTICATION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_ENCODER_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_ENCRYPTION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_EXECUTOR_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_HTTP_UTILITIES_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_INTRUSION_DETECTION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_LOG_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_RANDOMIZER_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_RESOURCE_FILE Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DEFAULT_VALIDATOR_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DIGITAL_SIGNATURE_ALGORITHM Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DIGITAL_SIGNATURE_KEY_LENGTH Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DISABLE_INTRUSION_DETECTION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.DISCARD_LOGSPECIAL Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ENCODER_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ENCRYPTION_ALGORITHM Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.ENCRYPTION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.logging.java.ESAPIErrorJavaLevel.ERROR_LEVEL
org.owasp.esapi.reference.DefaultSecurityConfiguration.EXECUTOR_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.FORCE_HTTPONLYCOOKIES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.FORCE_HTTPONLYSESSION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.FORCE_SECURECOOKIES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.FORCE_SECURESESSION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.HASH_ALGORITHM Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.HASH_ITERATIONS Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.HTTP_SESSION_ID_NAME Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.HTTP_UTILITIES_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.IDLE_TIMEOUT_DURATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.INTRUSION_DETECTION_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.IV_TYPE
org.owasp.esapi.reference.DefaultSecurityConfiguration.KDF_PRF_ALG Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.KEY_LENGTH Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_APPLICATION_NAME Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_CLIENT_INFO Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_SERVER_IP Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.LOG_USER_INFO Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.MASTER_KEY Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.MASTER_SALT Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.MAX_HTTP_HEADER_SIZE Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.MAX_OLD_PASSWORD_HASHES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.MAX_UPLOAD_FILE_BYTES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.PASSWORD_PARAMETER_NAME Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.PLAINTEXT_OVERWRITE Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.PREFERRED_JCE_PROVIDER Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.PRINT_PROPERTIES_WHEN_LOADED Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.RANDOM_ALGORITHM Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.RANDOMIZER_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.REMEMBER_TOKEN_DURATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.RESPONSE_CONTENT_TYPE Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.UPLOAD_DIRECTORY Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.UPLOAD_TEMP_DIRECTORY Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.USERNAME_PARAMETER_NAME Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATION_PROPERTIES Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATION_PROPERTIES_MULTIVALUED Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_ACTION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_IMPLEMENTATION Use same field name, but from org.owasp.esapi.PropNames instead.
org.owasp.esapi.reference.DefaultSecurityConfiguration.WORKING_DIRECTORY Use same field name, but from org.owasp.esapi.PropNames instead.

Deprecated Methods

Method and Description
org.owasp.esapi.crypto.CryptoHelper.arrayCompare(byte[], byte[]) Use java.security.MessageDigest#isEqual(byte[], byte[]) instead.
org.owasp.esapi.AccessController.assertAuthorizedForData(String, Object)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.assertAuthorizedForData(String, Object)
org.owasp.esapi.AccessController.assertAuthorizedForFile(String)
org.owasp.esapi.reference.DefaultAccessController.assertAuthorizedForFile(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.assertAuthorizedForFile(String)
org.owasp.esapi.AccessController.assertAuthorizedForFunction(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.assertAuthorizedForFunction(String)
org.owasp.esapi.AccessController.assertAuthorizedForService(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.assertAuthorizedForService(String)
org.owasp.esapi.AccessController.assertAuthorizedForURL(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.assertAuthorizedForURL(String)
org.owasp.esapi.crypto.CryptoHelper.computeDerivedKey(SecretKey, int, String) Use same method in KeyDerivationFunction instead. This method will be removed as of ESAPI release 2.3 so if you are using this, please CHANGE YOUR CODE. Note that the replacement is not a static method, so create your own wrapper if you wish, but this will soon disappear.
org.owasp.esapi.filters.SecurityWrapperResponse.encodeRedirectUrl(String) in servlet spec 2.1. Use SecurityWrapperResponse.encodeRedirectUrl(String) instead.
org.owasp.esapi.filters.SecurityWrapperResponse.encodeUrl(String) in servlet spec 2.1. Use SecurityWrapperResponse.encodeURL(String) instead.
org.owasp.esapi.SecurityConfiguration.getAccessControlImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getAllowedFileUploadSize() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getAllowedLoginAttempts() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getAllowMixedEncoding() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getAllowMultipleEncoding() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getApplicationName() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getAuthenticationImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getCharacterEncoding() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getCipherTransformation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getDigitalSignatureAlgorithm() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getDigitalSignatureKeyLength() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getDisableIntrusionDetection() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getEncoderImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getEncryptionAlgorithm() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getEncryptionImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getEncryptionKeyLength() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getExecutorImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getForceHttpOnlyCookies() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getForceHttpOnlySession() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getForceSecureCookies() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getForceSecureSession() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getHashAlgorithm() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getHashIterations() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getHttpSessionIdName() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getHTTPUtilitiesImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getIntrusionDetectionImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getIVType() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead. This method will be removed in a future release as it is now moot since it can only legitimately have the single value of "random".
org.owasp.esapi.reference.DefaultSecurityConfiguration.getIVType()
org.owasp.esapi.SecurityConfiguration.getKDFPseudoRandomFunction() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getLenientDatesAccepted() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getLogApplicationName() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getLogEncodingRequired() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getLogImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getLogServerIP() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getMasterKey() Use SecurityConfiguration.getByteArrayProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getMasterSalt() Use SecurityConfiguration.getByteArrayProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getMaxHttpHeaderSize() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getMaxOldPasswordHashes() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getPasswordParameterName() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getPreferredJCEProvider() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getRandomAlgorithm() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getRandomizerImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.filters.SecurityWrapperRequest.getRealPath(String) in servlet spec 2.1. Use ServletContext.getRealPath(String) instead.
org.owasp.esapi.SecurityConfiguration.getResponseContentType() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getSessionAbsoluteTimeoutLength() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getSessionIdleTimeoutLength() Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getUsernameParameterName() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.getValidationImplementation() Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.AccessController.isAuthorizedForData(String, Object)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.isAuthorizedForData(String, Object)
org.owasp.esapi.AccessController.isAuthorizedForFile(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.isAuthorizedForFile(String)
org.owasp.esapi.AccessController.isAuthorizedForFunction(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.isAuthorizedForFunction(String)
org.owasp.esapi.AccessController.isAuthorizedForService(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.isAuthorizedForService(String)
org.owasp.esapi.AccessController.isAuthorizedForURL(String)
org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController.isAuthorizedForURL(String)
org.owasp.esapi.filters.SecurityWrapperRequest.isRequestedSessionIdFromUrl() in servlet spec 2.1. Use SecurityWrapperRequest.isRequestedSessionIdFromURL() instead.
org.owasp.esapi.reference.crypto.DefaultEncryptedProperties.main(String[]) Use EncryptedPropertiesUtils instead, which allows creating, reading, and writing encrypted properties. main method will be removed in a future release.
org.owasp.esapi.SecurityConfiguration.overwritePlainText() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
org.owasp.esapi.SecurityConfiguration.setCipherTransformation(String) To be replaced by new class in ESAPI 2.1, but here if you need it until then. Details of replacement forthcoming to ESAPI-Dev list. Most likely to be replaced by a new CTOR for JavaEncryptor that takes a list of properties to override.
org.owasp.esapi.HTTPUtilities.setRememberToken(HttpServletRequest, HttpServletResponse, String, int, String, String)
org.owasp.esapi.HTTPUtilities.setRememberToken(String, int, String, String)
org.owasp.esapi.filters.SecurityWrapperResponse.setStatus(int, String) In Servlet spec 2.1.
org.owasp.esapi.SecurityConfiguration.useMACforCipherText() Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.

Deprecated Constructors

Constructor and Description
org.owasp.esapi.reference.AbstractAccessReferenceMap(Set<Object>) This constructor internally calls the abstract method AbstractAccessReferenceMap.getUniqueReference(). Since this is a constructor, any subclass that implements getUniqueReference() has not had its own constructor run. This leads to strange bugs because subclass internal state is initialized after calls to getUniqueReference() have already happened. If this constructor is desired in a subclass, consider running AbstractAccessReferenceMap.update(Set) in the subclass constructor instead.
org.owasp.esapi.reference.AbstractAccessReferenceMap(Set<Object>, int) This constructor internally calls the abstract method AbstractAccessReferenceMap.getUniqueReference(). Since this is a constructor, any subclass that implements getUniqueReference() has not had its own constructor run. This leads to strange bugs because subclass internal state is initialized after calls to getUniqueReference() have already happened. If this constructor is desired in a subclass, consider running AbstractAccessReferenceMap.update(Set) in the subclass constructor instead.
org.owasp.esapi.codecs.MySQLCodec(int)