How the Web Works

A web application usually combines a client, a server and supporting services such as databases and identity providers.

From URL to page

1. The browser parses the URL.
2. DNS resolves the hostname.
3. A TCP connection is established; HTTPS also negotiates TLS.
4. The browser sends an HTTP request.
5. The server processes routing, authentication and application logic.
6. The server returns a response.
7. The browser renders HTML and may request CSS, JavaScript and images.

Front end and back end

Front-end code runs in the user's browser and cannot be trusted to enforce security by itself. Back-end code must validate input, authenticate users and authorize every sensitive operation.

Same-origin concept

Browsers separate content by origin: scheme, host and port. Security controls such as the same-origin policy limit how one origin reads data from another, while CORS provides controlled exceptions.