# What is Web Application Security?

> Web application security is the application-security discipline applied to software delivered through web technologies and used through browsers or other web clients.

- Canonical URL: https://yellowcube.eu/glossary/web-application-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It protects client-side code, server-side logic, sessions, data, interfaces, and supporting configuration against unauthorized access, unsafe interpretation of input, abuse of browser trust, and other application-layer failures. The scope includes design, implementation, deployment, testing, monitoring, and remediation — not only perimeter filtering.

Web applications cross several trust boundaries: browser to server, one origin to another, application to data store, service to service, and code to third-party content. Security depends on preserving those boundaries while applying authorization and business rules to every sensitive action.

### Key points

- **Core controls:** Use secure session handling, server-side authorization, context-appropriate input and output handling, protected transport, safe error behavior, least privilege, and controlled integration with dependencies.
- **Browser-aware design:** Account for origins, cookies, framing, navigation, script execution, content loading, client-side storage, and the difference between browser-enforced policy and server-side trust decisions.
- **Verification and operation:** Review architecture and code, test authenticated roles and workflows, evaluate deployment configuration, monitor abuse and failures, and reassess after changes to the application or platform.
- **Important limitation:** A scanner or web application firewall can detect or block selected patterns, but neither can establish correct business logic, complete authorization, secure design, or adequate coverage of every application state.

### Related terms

[Application security](<https://yellowcube.eu/glossary/application-security/>) · [Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Dynamic application security testing (DAST)](<https://yellowcube.eu/glossary/dynamic-application-security-testing/>) · [Browser security](<https://yellowcube.eu/glossary/browser-security/>)

### Sources

[OWASP Application Security Verification Standard 5.0.0](https://owasp.org/www-project-application-security-verification-standard/) · [OWASP Web Security Testing Guide 4.2 (current stable)](https://owasp.org/www-project-web-security-testing-guide/v42/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.