Overview
Web security begins with understanding how the web actually works. At its core is the browser/server model — a client (the browser) making requests, and a server responding. This lesson establishes that model as the foundation for everything that follows.
Learning objectives
- Describe the browser/server (client/server) model of the web.
- Explain the request/response cycle at a high level.
- Identify where security boundaries sit between client and server.
Core concept
The web is a client/server system. The browser (client) requests resources; the server processes those requests and returns responses (pages, data, files). They communicate over HTTP/HTTPS (detailed in later lessons). A crucial security principle emerges immediately: the client is untrusted. Anything running in or sent from the browser is under the user's (or an attacker's) control and can be inspected or modified.
How it works
A browser sends a request to a server; the server runs application logic, perhaps queries a database, and returns a response the browser renders. The trust boundary lies at the server: the server must treat all incoming data as potentially hostile because it cannot control what the client sends. Client-side code (JavaScript, form validation) improves user experience but provides no security guarantee — an attacker can bypass it entirely and craft requests directly.
Practical example
When you submit a login form, the browser sends your input to the server, which checks credentials and responds. Even if the page uses JavaScript to require a strong password, an attacker can skip the page and send a raw request with any values. This is why real authentication and validation must happen server-side — the browser is a convenience layer, not a security layer.
Cybersecurity relevance
The browser/server split defines where security controls must live. A recurring root cause of web vulnerabilities is trusting the client — relying on client-side checks, hidden fields, or disabled buttons for security. Attackers operate at the request level, bypassing the UI. Understanding that the server must independently validate and authorize every request is the mental model underpinning the entire web-security path.
Common mistakes
- Trusting client-side validation as a security control — it can always be bypassed.
- Assuming the UI constrains what a user can send — attackers craft requests directly.
- Placing security logic in the browser rather than enforcing it on the server.
Key takeaways
- The web is a client/server model: the browser requests, the server responds over HTTP/HTTPS.
- The client is untrusted — anything in the browser can be inspected or modified by the user/attacker.
- Security controls (authentication, validation, authorization) must be enforced server-side; client-side code is a convenience, not a guarantee.
Check your understanding
- Why must the server treat all data received from the browser as untrusted?
- Why is client-side validation alone insufficient as a security control?