How the Web Works

You cannot secure something you do not understand. That is just a fact. Before we can talk about web vulnerabilities and how to defend against them, we need to understand how the web actually works under the hood.

I know what you are thinking. "I already know how the web works. I build websites." But trust me, most web vulnerabilities exist because developers do not fully understand the underlying protocols. There is a gap between how we think the web works and how it actually works. Attackers exploit that gap.

So let us close that gap. We are going to look at how HTTP and HTTPS work, how DNS resolves domain names, how browsers enforce security boundaries, and how cookies and sessions keep us logged in. Each of these topics has security implications that we will revisit throughout the rest of the book.

This chapter might feel like a refresher if you have been developing for a while. But I promise, looking at these fundamentals through a security lens will change how you think about them. Let us get into it.