Summary

What is a Web application? When asked this, most people think of an ASP, ASP.NET, PHP, or JSP application or perhaps a Web service. The defining feature of a Web application is the transport, not the technology used to implement it. Both traditional Web sites and Web Services use http as their transport. The effect of this is that http is becoming overloaded—not only is it used for delivering Web pages, but it’s also used for delivering rich information such as passwords and Web services. This means that applications need to be secured along with the network perimeter. As you’ve seen in this chapter, there are simple steps you can take to secure Web applications, and these are discussed in more detail in Chapter 11 and Chapter 13.

This chapter brings to a close the first section of this book, with guidelines for applying practices to secure Web form applications and Web services. Many chapters in this first section only scratch the surface of security—you could write an entire book on code-access security, encryption, or ASP.NET authentication and authorization. What this first section does deliver is an understanding of the architecture you can build on. The next section concentrates on specific lower- level coding and testing techniques for writing secure applications.