1. A method of checking an access control list for a web application comprising the steps of: a) receiving a request from a web client; b) parsing the request to an application firewall; said application firewall having a rule and residing independently of the web application, said rule having syntax to identify a parameter in the request; c) checking the received request based on said rule; d) allowing the received request passing through the application firewall upon matching the rules; and e) checking the access control list with an authentication provider.