The growth of inexpensive bandwidth and the maturation of Web development technology have enabled a significant adoption of Web-based applications for interactions between customers and business, between businesses, and between citizens and institutions. However, those same improvements in bandwidth and corresponding rise in Web system complexity has also been of use to those with malicious intent. Thus Web security (the applications and the site itself) is of increasing importance to academics, industry, and government. This working session is meant to stimulate discussion among all symposium participants related to research directions in Web security.