Web application

Architecturally most web applications are three-tier: presentation in the browser (HTML, CSS, JavaScript), application logic on servers, and persistent data in a database. The rendering model varies: classic multi-page applications render HTML on the server for each navigation; single-page applications load a JavaScript bundle once and render client-side from JSON APIs; hybrid frameworks render on the server and then hydrate in the browser; static generation pre-builds pages at deploy time. In front sit reverse proxies, load balancers, CDNs and often a web application firewall. Sessions are carried in cookies or bearer tokens, and login is increasingly delegated to an identity provider over OpenID Connect or SAML; Danish public-sector services typically authenticate citizens with MitID through a broker.

The decisive security fact is the trust boundary: everything arriving from the browser, including hidden fields, cookies, headers and the JavaScript itself, is under the user's control. Client-side validation is a usability feature; authorisation must be enforced on the server for every request and every object. That is why A01:2025 Broken Access Control tops the OWASP Top 10:2025, followed by A02 Security Misconfiguration and the new A03 Software Supply Chain Failures, which reflects that most application code today is third-party dependencies. Injection, including cross-site scripting, is A05:2025. Recurring concrete flaws are insecure direct object references, stored and DOM-based XSS, CSRF, SSRF through URL-fetching features, unsafe file uploads and insecure deserialisation.

Part of the defence is delivered by the application to the browser through response headers: Content-Security-Policy restricts script sources and, via frame-ancestors, framing (clickjacking); Strict-Transport-Security enforces HTTPS; X-Content-Type-Options: nosniff stops MIME sniffing; Referrer-Policy limits URL leakage; and the Secure, HttpOnly and SameSite cookie attributes protect sessions. On the server, contextual output encoding (preferably via auto-escaping templates), parameterised queries and framework CSRF tokens remove whole bug classes.

Assurance is structured by OWASP's Application Security Verification Standard, whose version 5.0 was released in May 2025 with graded verification levels, and by the Web Security Testing Guide for testing methodology, combined in the development pipeline with SAST, software composition analysis and DAST, and before release with penetration testing. A web application differs from a website, which mainly publishes content, and from a native app, which is installed and runs outside the browser sandbox; a single-page application is still a web application even though much of its logic has moved to the client, and its API must then be defended as a public interface in its own right.