I don&#x27;t really work on application side of web: handed that part off to others while I did client-server plumbing and endpoints. Web is simply too much risk for high-assurance security.<p>Plus, a brain injury in an accident cost me most of my memory. I operate on fragments now while trying to reconnect stuff. I probably knew about the guide and forgot. Or I didn&#x27;t but used something else. Usually remember a lot of INFOSEC stuff but this one is total blank. So, such resources are good for getting stuff back in my head.<p>Here&#x27;s last list I put up when my memory was working better than ATM that detailed what kinds approaches I recommended or used (often in combination):<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;04&#x2F;the_security_of_8.html#c5626550" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;04&#x2F;the_security_...</a><p>I know I used a SPECTRE clone in the past for at least one legacy app. Did high-assurance HTTP to prevent defacing. Did an application server on microkernel similar to Barracuda&#x27;s nice architecture to keep TCB minimal. Outside SPECTRE, it&#x27;s what we all did in high-assurance though: certain things everyone seems to build. The rest and all details are a blank. Sorry...<p>Barracuda lightweight approach
<a href="https:&#x2F;&#x2F;realtimelogic.com&#x2F;products&#x2F;lua-server-pages&#x2F;" rel="nofollow">https:&#x2F;&#x2F;realtimelogic.com&#x2F;products&#x2F;lua-server-pages&#x2F;</a>