Web application security is the set of practices that keep a site, its users, and its data safe from misuse through the browser.
It covers sign in, sessions, input handling, storage, dependencies, errors, and logs, not only a filter in front.
How it works
Each request must prove who the caller is and whether that caller may touch the object.
Safe interfaces keep visitor input from changing the meaning of a database command or a file path.
A firewall can reduce some hostile traffic, yet the application still enforces its own rules.
Knowing which libraries you ship, and updating them, is part of the same duty.
Concrete examples
- A session ends on sign out and cannot be reused by someone else.
- A file download checks that the caller owns that file before sending it.
- A framework update removes a known flaw from a dependency you ship.
Protective measures
- Require strong authentication and make sessions expire and end on sign out.
- Check authorization on every request, not only on the page that links to an action.
- Handle input through safe interfaces such as parameterized queries.
- Keep a list of libraries and update them when the vendor ships a fix.