Web Tech Exam Prep Notes

Topic 1 – Web Architecture & Security Fundamentals

Middleware;
Client → Middleware → Controller/API → Database
Every requests passes through middleware before reaching API.
What Middleware Does?
- Authentication
- Authorization
- Logging
- Exception Handling
- Rate Limiting
- Request Validation
- Response Modification
Example (in Flow);
- User Requests
- Authentication Middleware
- Authorization Middleware
- Logging Middleware
- Controller
Without Middleware;
- Anyone may reach APIs
- No Centralized Security
- No Request Logging
- Harder maintenance
Middleware acts as a request-processing pipeline that intercepts
incoming requests and outgoing responses. It performs cross-cutting
concerns such as authentication, authorization, logging, exception
handling, and request filtering before forwarding requests to
application logic.
How it looks in [Link];
 Authentication vs Authorization
Authentication;
”Who Are You?”
System Verifies Identity.
Authorization;
“What Can You Do?”
Checks for Permissions.

Authentication = Login
Authorization = Permissions

RBAC (Role Based Access Control);

Roles such as Admin, Moderator, Guests, etc are assigned as
permissions after authentication.
Each Role has different responsibilities and abilities.

IDOR (Insecure Direct Object Reference);

Security vulnerability that occurs when an application exposes a
direct reference to an internal database object like an ID number in a
URL or API request, and fails to validate if the logged in user actually
owns or has permissions to see that object.
Most Common and Dangerous Vulnerabilities in web apps.
Suppose if an API is;
/api/users/13
The user can change it to;
/api/users/12
And can view a different record. This is IDOR.
Consequences of IDOR;
- Privacy violations
- Financial losses
- Legal penalties
- Reputation damage
- Data leakage

SaaS vs PaaS
SaaS;
Software as a Service which is when a ready made software is
provided as a service to users such as;
- Microsoft 365
- Google Docs
- Zoom
User simply uses the software. No coding required

PaaS;
Platform as a Service which is when developers use a Platform such
as;
- Azure App Service
- Google App Engine
Developers deploy their own applications.
 State Management
Why it Exists?
HTTP is Stateless meaning every request is independent, the server
does not remember what was the last request or the previous ones.
If a User Logs in then the servers responds to that but it wont
remember that the user is now logged in.
In this case the state of user being Logged in shall be maintained.
State;
Application remembers data. Such as logged in users, shopping carts,
notifications, chat messages, etc.
Where are States Stored?
- Browser Storage: Local Storage which persists even after the
browser closes. But storage is small from 5MB to 10MB of text
data per domain. Mostly used for preferences such as dark-
mode, offline data caching or persistent layout configs.
- Session Storage: Temporary storage which is removed when the
tab is closed. It is Isolated meaning if 2 tabs are open then each
tab has its own session storage instance. Used for multi-page
forms, shopping cart during checkouts, or transient filtering
options that are terminated if a new tab is opened.
- Session State: This is done on the server side and this lives in
backend memory or session databases such as Redis. the server
keeps track of the user by dropping a tiny encrypted cookie
containing a unique session ID onto the user’s browser. That ID is
also passed in the HTTP requests and uses the session ID from
memory to show user’s state. Highly Secure
- URL Parameters: key-value structure query is appended to the
URL with a question mark “?” which helps the backend to
 identify. Increases shareability as the URL now holds that state
and the URL can be shared anywhere. Mostly used in search
engines, product filtering, sorting states, etc.
- Shared Services (Angular): Multiple Components share the
same data, a TS class is injected as a Singleton across the
application and any component using that class and updates a
variable, that variable will automatically be updated in all
components.

Routing: Routing Maps URL → Controller Action

Attribute Routing: Routes Defined Inside Controller
Conventional Routing: Routes defined in [Link]

Route Parameters:
“/products/15”
Here 15 is a parameter
Query Strings;
“/products?page=2”
Here after “?” page=2 is a query string.
Nested Strings;
“/orders/105/items”
Items belong to orders
Versioning;
“/api/v1/products”
“/api/v2/products”
Allows newer APIs
 Minimal APIs
Traditional;
Controller → Action
Minimal API;
Inside [Link], endpoints are created such as;

app. MapGet( “ / products ” , () => …)

directly created without the need of controllers.

Advantages;
- Less Code
- Faster Development
- Lightweight
Disadvantages;
- Harder for Larger systems

Model Binding
[Link] automatically creates incoming requests data into C#
objects such as converting JSON format into a C# object of
“Product product ”
Automatic conversion. No Manual Parsing.
 Dependency Injection
Instead of creating objects manually in each classes using new
keyword, we can inject them such as in Constructors.
Without DI;
“ProductService service = new ProductService(); ”
With DI;
“public ProductsController ( ProductService service) {}”
Framework Injects Dependency
Benefits;
- Loose Coupling
- Easier Testing
- Cleaner Code
 Layered Architecture
Controller → Service → Repository → Database
Controller Layer;
Receives requests
Ex: GET /products
Service Layer;
Business Logic
Ex: Calculate Discounts, Validate Orders
Repository Layer;
Database Operations
Ex: GetProducts(), AddProduct()
Database Layer;
Stores Data
Ex: SQLite, SQL Server, etc

For Problems such as Business Logic inside endpoints, Duplicate

Routes, Inconsistent APIs.
Layered Architecture is the solution
 Azure Cloud Deployment
What is Azure?
Microsoft Azure is Microsoft’s Cloud Platform, it provides;
- Hosting Applications: Running web apps, mobile backends, full
corporate software systems
- Data Storage: Safely storing terabytes of databases, files, and
backups with guaranteed redundancy.
- AI & Machine Learning: providing pre built AI models for speech,
translation and data analysis.
- Networking: Connecting worldwide offices via secure private
networks (VPNs).
Azure Cloud Deployment;
Process of packaging your software code or config files and pushing
them live onto azure’s infrastructure so users around the world can
access it.
- IaaS (Infrastructure as a Service)
- PaaS (Platform as a Service)
- FaaS / Serverless (Function as a Service)
Azure CLI;
Azure Command Line Interface is a cross-platform text command tool
that allows us to create, manage and delete Azure Cloud Resources
directly from your local terminal (CMD, PowerShell, or macOS).
Instead of clicking through the graphical buttons on the Azure web
portal dashboard, you type quick, scriptable text commands.
Such as for login;
“az login ”
Or to create a brand new resource group in a specific region;
“az group create -- name MyGroup -- location eastus ”
Because it uses plain text commands, the Azure CLI allows engineers
to write automation scripts to deploy entire enterprise data
infrastructures in seconds.
Steps to Deploy Application
Step 1;
dotnet public -c Release -o ./publish
This will;
- Compile the Project
- Create optimized Release Build
- Place output in “publish” folder
Output;
“publish/”
Contains deployable files.
Step 2;
az webapp create
--name myapp
--resource-group mygroup
--plan myplan
Creates Azure Web App
Determines CPU, RAM, Pricing
Resource Group;
A group which contains our Web App, Database, Storage all organized
together.
App Service Plan;
Defines CPU, Ram, Pricing Tier, Scaling
Step 3;
az webapp deploy
--name myapp
--resource-group mygroup
--src-path ./publish
Uploads published files to Azure
Deployment complete.

Full Workflow;
- Develop [Link] Core App
- dotnet publish
- Create Azure Web App
- Deploy Publish Folder
- Application Live

What is Azure App Service?

Platform as a Service (PaaS) offering used to host web applications
without managing infrastructure.
Deployment Steps (Short);
- Build Application;
dotnet publish -c Release -o ./publish
- Create Web App;
az webapp create …
- Deploy Application;
az webapp deploy
Advantages;
- No server management
- Automatic scaling
- High availability
- Faster deployment
- Cross-platform hosting