Skip to main content

Web & Networking Foundations · Foundational context for A04:2021 - Insecure Design

Anatomy of a Modern Web Application

Map a modern web app's client, server, API, and data tiers, then identify where security controls must be enforced.

Before we begin, here is exactly what you will be able to do by the end of this lesson.

By the end of this lesson, you will be able to:

  • Name and describe the three tiers of a modern web application: the client (browser), the server (back end), and the data store (database) — and explain which machines each tier runs on.
  • Identify the single-page application pattern, REST API calls, and JSON data exchange in a running application's Network tab.
  • Explain the fundamental trust boundary — why the client tier is attacker-controlled and why the server must re-validate every security-relevant decision independently.
  • Map the major OWASP vulnerability classes (injection, broken access control, DOM XSS, reflected/stored XSS) onto the application tier where each one lives.

When you are ready, send Continue.