Built-in security
Wt automatically protects against misuse by only allowing visible and enabled widgets to be interacted with. This also helps to avoid CSRF attacks, which are doubly avoided because Wt does not store session information in cookies. By using the widget abstraction, Wt discourages the inserting of raw HTML into a web page, preventing XSS attacks. Wt::Dbo prevents SQL injection by encouraging the use of prepared statements when accessing the database. Wt also includes an authentication and registration system with support for OAuth providers like Google, Facebook, and OpenID Connect.