Web Foundations & Databases · beginner · ~11 min

How the web works: client, server, request, response

Trace a page load and separate frontend from backend responsibilities.

Overview

The web is request/response over HTTP between a browser (frontend: HTML/CSS/JS, user-controlled) and a server (backend: logic, auth, DB). Because the frontend is attacker-controlled, every security decision must be enforced on the backend.

Why it matters

The frontend/backend trust line is the root of most web vulnerabilities: hidden buttons, disabled fields, and client-side validation are bypassed by crafting requests directly. Recognising what's enforced where is the core web-pentest instinct.

Core concepts

Request/response. Method + URL + headers + body each way. Frontend. HTML/CSS/JS in the browser — fully user-controlled. Backend. Server logic the user never sees. Trust line. Security must be enforced server-side; client checks are UX only.

Lesson

A web app is a conversation between a client (browser) and a server, carried over HTTP.

The round trip

  1. The browser sends an HTTP request (method + URL + headers, maybe a body).
  2. The server runs backend code, perhaps queries a database, and returns an HTTP response (status + headers + body).
  3. The browser renders the body.

Frontend vs backend

  • Frontend runs in the browser: HTML (structure), CSS (style), JavaScript (behaviour). It is fully under the user's control — anyone can read and modify it with devtools.
  • Backend runs on the server: application logic, authentication, database access. The user never sees its code, only its responses.

The security line

Because the frontend is attacker-controlled, no security decision can live there. JavaScript that "disables" a button, hides an admin link, or validates a form is a UX nicety, not a control — an attacker simply crafts the request directly (with curl, Burp, or devtools). Every check that matters must be re-done on the backend. This single idea underlies a huge fraction of web vulnerabilities.

Summary

Web apps are HTTP conversations between a user-controlled browser and a trusted server. The frontend cannot enforce security, so every meaningful check belongs on the backend — the principle behind most web bug classes.

Practice with these exercises