Application security comes in many flavors; the two that most concern Web applications are authentication and authorization. Authentication is the most frequently discussed security topic. By definition, when you authenticate an item of any kind, you verify that the item is what it claims to be. For example, a Web application might need to authenticate the application's users and make sure that the users are who they say they are. To authenticate a user, you typically ask the user for a username and password.

In ...