Aspects of the invention relate to a computer-implemented method of controlling a computer application program in a computer system configured for electronically communication with a client. The computer system is configured to have access to a first request set of one or more allowable requests corresponding to a first application state of the computer application program. The computer application program may run on the computer system or on one or more other computer systems. A client request is received at the computer system for the computer application program. The computer application program is in the first application state in relation to said client (using e.g. the client connection). The client request is analysed to determine if the client request matches one of the allowable requests corresponding to the first application state of the computer application program. The computer application program is controlled by instructing this program to execute the client request only if the client request matches an allowable request of the first request set.