Front end and back end
| English | Chinese | Pinyin |
|---|---|---|
| front end | 前端 | qián duān |
| back end | 后端 | hòu duān |
| server | 服务器 | fú wù qì |
| request | 请求 | qǐng qiú |
| response | 响应 | xiǎng yìng |
| API | 应用程序接口 | yìng yòng chéng xù jiē kǒu |
| JSON | 数据交换格式 | shù jù jiāo huàn gé shì |
Two computers, one application
- The front end 前端 runs in the visitor's browser. The back end 后端 runs on a server you control.
- A server 服务器 receives a request 请求 and returns a response 响应. That loop is the whole architecture.
- Everything in GAC011 was front end. This module is what sits behind it.
Put one interaction with a web app in order.
Every feature in this module is this loop with different contents.
What belongs on the server
- Anything secret — a password, an API key, a database connection — belongs on the back end only.
- Code sent to a browser is readable by everyone who visits, including the parts you meant to hide.
- Any rule that must be enforced rather than merely convenient also belongs on the server, because the browser can be bypassed.
Where must a database password live?
Front-end code is downloaded to every visitor's machine by definition. Minifying hides nothing.
Requests, responses and APIs
- An API 应用程序接口 is the agreed shape of those requests and responses: which URLs exist, what they expect, what they return.
- Data usually travels as JSON 数据交换格式, which is text both sides can parse.
- The browser asks; the server answers. Nothing else in this module changes that.
What text format is normally used to send data between browser and server?
Both sides can parse it, and it is readable when you are debugging.
Where a rule has to live.
A form must not accept an empty name. Checking in the browser gives the visitor an instant message, which is good.
But a request can be sent without ever loading your page. So the server must check it too — and only the server's check is a rule. The browser's is a courtesy.
Both are worth writing. Only one of them is a defence.
A request can reach your server without your page ever being loaded.
Which is exactly why the server must check every rule itself, whatever the browser already checked.
Anything the browser can do, a visitor can do differently. Design as if every request might have been crafted by hand, because eventually one will be. That single assumption prevents most of the failures in this module.
In one sentence, explain why client-side validation is not a defence.
Example: "A visitor can send a request without loading the page at all, so any check the browser makes can simply be skipped."
Never put a database password, an API key or an admin token in front-end code. "It is minified" or "nobody will look" are not protections — the file is downloaded to every visitor's machine by definition.