Lesson 1.4: Anatomy of a web application
What happens between a browser and a database: the front end, the web server and reverse proxy, the application (here PHP running under PHP-FPM), the database and the API. Each part is a place where security can fail. In the lab you sit on web01, the server of the Northwind Shop, and trace a request through every layer: the response headers, a JSON API, the nginx configuration that hands PHP files to PHP-FPM, the listening services, the PHP files that make up the application and its database connection.
17 min
You will learn to
- Name the parts of a web application and what each does
- Explain the role of a web server, PHP-FPM and the database
- Read a server's response headers
- Find an application's entry points (its PHP files and API)
- Explain why each layer is part of the attack surface
Key terms
- Web application
- A program you use through a browser: it receives HTTP requests, runs code and answers with pages or data.
- Front end and back end
- The front end runs in the browser (HTML, CSS, JavaScript); the back end runs on the server (application code and database).
- Web server and reverse proxy
- The program that receives HTTP requests, serves files and passes dynamic requests to the application. As a reverse proxy it sits in front of the application.
- PHP and PHP-FPM
- PHP is a programming language made for the web; PHP-FPM (FastCGI Process Manager) keeps PHP worker processes running and executes PHP files for the web server.
- Database
- Where the application keeps its data in tables: users, products, orders. Queried with SQL.
- API
- An interface that answers programs rather than people, usually with JSON over HTTP.
- Endpoint
- One address the application answers: a page, a form target or an API route.
← What is a computer network? · All lessons · Why it matters: lessons from real incidents →