A web application is software that runs through a browser instead of being installed as a native desktop program. It usually combines client-side code in the browser with server-side services, databases, and APIs. Users interact with it over HTTP or HTTPS, and the application often keeps state through cookies, tokens, and sessions.
Web applications matter in cyber security because they are directly exposed to the internet and sit on a large attack surface. Common threats include cross-site scripting, SQL injection, cross-site request forgery, authentication abuse, and session hijacking. Defenders reduce risk with secure coding, input validation, output encoding, strong authentication, least privilege, rate limiting, patching, and browser controls such as content security policy. In practice, protecting a web application means protecting both the code and the trust boundaries around it.