Skip to content
Chapter 01 · Slide Breakdown

Introduction to the Web

This is the only chapter in SE371 with almost no code in it, and that is exactly why people lose marks on it. It is pure recall: layers, codes, acronyms, and the order of a DNS lookup. Treat it like a vocabulary exam, not a programming one.

59 slidesTwo decks in oneMostly recallBook ch. 1 + 2

What this chapter is really for

The PDF is two decks stapled together. Slide 1–21 is Chapter 1-a: Introduction to Web Development and slide 22–58 is Chapter 1-b: How the Web Works. They are graded very differently, so study them differently.

Part A (slides 1–21) — context

History, circuit vs packet switching, web vs desktop apps, static vs dynamic, Web 2.0, client-server, internet infrastructure. Almost entirely narrative. Skim it once, memorize five dates and one comparison table, move on.

Part B (slides 22–58) — the machinery

The four-layer model, IP, TCP vs UDP, DNS, URL anatomy, HTTP methods, headers, status codes. This is where the marks are, and it is also the foundation you will silently rely on in every later chapter — GET vs POST in ch. 2 forms, ports in ch. 6 Node, status codes in ch. 7 REST APIs.

The single most useful thing you can take out of this chapter is a mental picture of what happens between typing a URL and seeing a page. Everything else in the chapter hangs off that one story.

The whole chapter in one sentence: you type a URL → DNS turns the name into an IP → TCP opens a connection on a port → HTTP sends a request with headers → the server replies with a status code and a body → the browser parses the HTML and fetches every referenced asset.

All 59 slides, weighted

SlidesTopicWeightWhat to do with it
1–4Title, syllabus, prerequisitesSkimSlide 3 lists the technical prerequisites: zip/unzip, cd navigation, conditionals, loops, try/catch, objects. If any of those are shaky, fix them now — ch. 4 assumes all of them.
5–8Internet vs WWW, circuit vs packet switching, birth of the webMemorizeKnow that the Internet is the network and the WWW is one service on it. Memorize the five things Berners-Lee defined (slide 8): URL, HTTP, web server software, HTML, browser.
9–11Web apps vs desktop apps; KSA personal data protection lawMemorizeClassic "list three advantages / three disadvantages" question. Build the two-column table once and reread it.
12–14Static → dynamic → Web 2.0MemorizeThe key line on slide 14: Web 2.0 moved programming logic from the server into the browser, which is why you have to learn JavaScript.
15–17Why programs are needed; the client-server modelMemorizeThe examinable sentence is on slide 17: the essential characteristic of a server is that it listens for requests and responds.
18–21Physical internet, undersea cables, Tier 1 backboneSkimRead once. Only "Tier 1 networks = the backbone" is likely to be asked.
22–24Part B title, objectives, what a protocol isSkimA protocol is a set of rules partners use when they communicate. One line, learn it verbatim.
25The four-layer TCP/IP modelMemorizeHighest-value single slide in Part A/B. Know all four layers, in order, and one job each.
26–29Link layer, internet layer, IPv4/IPv6, PATMemorizeIPv4 = four 8-bit integers, dotted. IPv6 = eight 16-bit integers, hex. IPv4 exhausted in 2011; PAT is the workaround.
30–32Transport layer: TCP guarantees, UDP trade-offMemorizeTCP = sequence numbers + ACK + retransmit = ordered and guaranteed. UDP = no guarantee, used for streaming, VoIP, games and DNS.
33Application layer protocolsMemorizeHTTP, SSH, FTP, POP/IMAP/SMTP, DNS. Know one sentence each.
34–39DNS, name levels, gTLD vs ccTLDMemorizeThe three gTLD subtypes (unrestricted / sponsored / new) are a favourite. So is the fact that .arpa is the third TLD category, used for reverse lookups.
40–42Registrars, ICANN, KSA registrationMemorizeICANN oversees TLDs and accredits registrars. In KSA, .sa started 1995 and the Arabic TLD in 2010; government domains go through the DGA.
43–44Address resolution, all ten stepsMemorizeCache → primary DNS → root → TLD server → authoritative server → IP. Draw the arrows from memory; that is the exam answer.
45–48URL anatomy: protocol, domain, port, path, query stringWrite itYou must be able to label a URL part-by-part and say which parts are optional. Port 80 is the HTTP default; query strings are ?key=value&key=value.
49–51HTTP, headers, request methodsMemorizeRequest headers describe the client (Host, User-Agent, Cache-Control). Response headers describe the server and payload (Server, Last-Modified, Content-Type, Encoding).
52–53GET vs POSTMemorizeThis reappears in ch. 2 (forms), ch. 5 (submit handling) and ch. 7 (CRUD). Learn it properly once here.
54–55Response codes and the code tableMemorizeKnow the four families by first digit, plus 200, 301, 304, 401, 404, 414, 500 individually.
56–58How browsers render; web servers and stacksMemorizeA web server is "nothing more than a process that responds to HTTP requests". The five stack layers on slide 57 preview the whole course.

Context: how the web got here, and why it matters to you

Internet ≠ WWW

The Internet is the global network of connected machines and the protocols that run on it. The World Wide Web is one service delivered over that network, the one that speaks HTTP and exchanges HTML. Email, SSH and file transfer are also on the Internet and are not the Web. The slides open with this distinction because the rest of Part B is about the Internet, not the Web.

Circuit switching vs packet switching

Circuit switchedPacket switched
ModelA continuous physical circuit is held open for the whole conversation, as with an operator plugging a wire into a switchboard.The message is split into packets that are routed independently and reassembled at the far end.
BandwidthInefficient — the line is reserved even when nobody is speaking.Efficient — the line carries other traffic between your packets.
ScalingDifficult to scale.Scales to the modern Internet.
EraEarly telephony.1960s ARPANET → 1974 X.25 → 1979 USENET → 1981 TCP/IP → adopted across ARPANET on 1 Jan 1983.

The five things Berners-Lee defined (1992)

Slide 8 is a list that maps almost perfectly onto the rest of this course, which makes it easy to remember and easy to examine:

  1. URL — uniquely identifies a resource (chapter 1)
  2. HTTP — describes how requests and responses operate (chapter 1)
  3. Web server software — responds to HTTP requests (chapter 6)
  4. HTML — publishes documents (chapter 2)
  5. A browser — makes requests and displays what it receives (chapters 3–5)
Memory hook for the five: “You Have Some Web Bits”URL, HTTP, Server, Web page (HTML), Browser.

Web apps vs desktop apps

AdvantagesDisadvantages
Accessible from any Internet-enabled computerRequires an active Internet connection
Work across operating systems and browsersSensitive data travels over the Internet
Updates roll out by changing the server onlyStorage, licensing and use of uploaded data raise concerns
Centralised storage means fewer local-storage security concernsAppearance differs across browsers
Restrictions on installing software or accessing hardware (Flash on iOS)
Plugins can interfere with JavaScript, cookies and advertisements

Static → dynamic → Web 2.0

Static site

The server sends a file that was already written. Every visitor gets identical bytes.

Dynamic server-side site

A program on the server generates the page per request, usually from a database. This is what you build in chapters 6 and 7.

Web 2.0

Users both contribute and consume content. For a developer, the important half is that logic moved from the server into the browser — which is the reason chapters 4 and 5 exist.

Client-server

Clients vary wildly in OS, speed, screen size, memory and storage. Servers are built for traffic and bandwidth. The defining property of a server is that it listens for requests and responds.

The machinery: layers, addresses, and name resolution

The four-layer model

TCP/IP was originally abstracted as four layers. Later models subdivide it into five or seven, but this course uses the four-layer version, and questions are phrased in its terms.

LayerJobKey terms
4. ApplicationProcess-to-process communication — the protocols developers actually touch.HTTP, SSH, FTP, POP/IMAP/SMTP, DNS
3. TransportEnsures transmissions arrive in order and without error.TCP (sequence numbers, ACK, retransmit), UDP (no guarantee)
2. InternetRoutes packets between partners across networks. Best-effort only — no reply expected, no guarantee of arrival.IP, IPv4, IPv6, PAT
1. LinkPhysical transmission across the medium and logical links: packet creation, transmission, reception, error detection, collisions, line sharing.MAC address
Mnemonic (bottom → top): Link, Internet, Transport, Application“Little Imps Take Aim”. Or remember the job words in order: wire → route → reliable → readable.

IP addresses

IPv4

Four 8-bit integers separated by dots, e.g. 129.89.23.1. The address space was effectively depleted in 2011.

IPv6

Eight 16-bit integers, each written in hexadecimal for readability. Over a billion billion times as many addresses as IPv4.

PAT (Port Address Translation) lets multiple unrelated networks share one public IP address, which is how the coffee shop, your home and the university all keep working despite IPv4 exhaustion. It is a stopgap; IPv6 is the long-term answer.

TCP vs UDP — the trade-off

TCPUDP
GuaranteeMessages arrive, and arrive in order.No guarantee at all.
HowEach packet has a sequence number; each arrival is acknowledged (ACK); missing packets are retransmitted.Fire and forget.
CostOverhead of tracking and retransmitting.Fast and cheap.
Used forThe web (HTTP), file transfer, email.Live streaming, VoIP, online games, DNS.

The slide’s example is worth keeping: a broadcaster streaming a match to millions cannot afford to track and retransmit every lost packet, and a small amount of loss is acceptable because viewers still see the game.

DNS: why it exists

Humans do not remember numeric addresses. In the ARPANET era a single downloadable hosts file mapped names to IPs; that stopped scaling, so it was replaced by the distributed Domain Name System. A second, less obvious benefit: because the name is separate from the address, a site can move to a different host without changing its name.

Name levels and TLD categories

CategoryMeaningExamples
gTLD — unrestrictedAnyone may register..com .net .org .info
gTLD — sponsoredRestricted to a sponsoring community..gov .mil .edu
gTLD — newOpened by ICANN from June 2012; over 1000 created..art .cash .cool .jobs .tax
ccTLDControlled by the country it represents, so each is administered differently. UK businesses register under co.uk; .ca is open to anyone living or doing business in Canada..sa .uk .ca
.arpaReserved for reverse DNS lookups.

IDN (Internationalized Domain Names) allow non-ASCII characters and have been deployed since 2009 — over 9 million exist. Registration in KSA: .sa from 1995, the Arabic-script TLD from 2010; since February 2021 accredited registrars serve individuals and non-government entities, while government entities register through the Digital Government Authority. ICANN oversees top-level domains, accredits registrars and coordinates DNS.

Address resolution — the ten steps

Draw this from memory. It is the most likely long-answer question in the chapter.

  1. Client requests a domain.
  2. The client computer checks its local DNS cache.
  3. If it is not cached, the computer asks its primary DNS server.
  4. If that server has no cached record, it asks a root name server.
  5. The root server returns the address of the relevant TLD server.
  6. The DNS server requests the record from that TLD server.
  7. The TLD server returns the addresses of the domain’s authoritative DNS servers.
  8. The DNS server asks one of those authoritative servers for the IP.
  9. The authoritative server returns the IP address.
  10. The client finally makes its actual request to that IP.
Shortcut for the chain: Cache → Primary → Root → TLD → Authoritative → done. Five hops, then the real request. If you can say those five words in order you can reconstruct all ten steps.

Domain registration, in order

  1. Registrant searches for a domain via a registrar or reseller portal.
  2. The registrar queries the TLD registry operator for availability.
  3. If available, the registrant pays and supplies WHOIS information.
  4. The registrar pushes the WHOIS data to the TLD registry operator.
  5. The registry operator adds it to its authoritative list.
  6. The registry operator pushes DNS information out to the TLD name servers.

URL anatomy and HTTP — the part you keep using all semester

Label every part of a URL

URL anatomyOnly protocol + domain are required
https://www.funwebdev.com:8080/pages/search?term=css&page=2#results
└─┬─┘   └────────┬───────┘ └─┬─┘ └─────┬────┘ └───────┬───────┘ └───┬──┘
  │              │            │        │             │             │
  │              │            │        │             │             └─ fragment (browser only, never sent to the server)
  │              │            │        │             └─ query string: key=value pairs, ? starts it, & joins them
  │              │            │        └─ path: maps to a location under the server root
  │              │            └─ port: OPTIONAL. Defaults to 80 for http, 443 for https
  │              └─ domain (or IP address) to connect to        ← REQUIRED
  └─ protocol used to connect                                   ← REQUIRED

Two details the slides call out explicitly. Port: not commonly used on production sites, but useful to route requests to a test server, to stress test, or to get around filters; http://funwebdev.com:8080/ connects on port 8080. Path: the server root corresponds to a real folder on the server — often /var/www/html/ on Linux or /inetpub/wwwroot/ on Windows — and when you request a folder rather than a file, the server decides which file to send you.

The request/response cycle

What actually crosses the wireHTTP defaults to TCP port 80
── REQUEST ─────────────────────────────────────────────
GET /pages/search?term=css HTTP/1.1
Host: www.funwebdev.com          ← which site, on a shared IP
User-Agent: Mozilla/5.0 ...       ← data about the client machine
Cache-Control: max-age=0

── RESPONSE ────────────────────────────────────────────
HTTP/1.1 200 OK                    ← status code
Server: nginx/1.24.0             ← data about the server
Content-Type: text/html; charset=utf-8
Last-Modified: Tue, 18 Feb 2026 09:14:02 GMT
Content-Encoding: gzip

<!DOCTYPE html>                    ← optional message body
<html> ... </html>

HTTP establishes a TCP connection on port 80 by default, the server waits for the request, then responds with headers, a response code, and an optional message which may include files. Headers are described by the slides as one of the most powerful aspects of HTTP: request headers carry data about the client machine, response headers carry data about the server and the data being sent.

GET vs POST

GETPOST
PurposeAsk for the resource at a URL.Transmit data to the server, normally from an HTML form.
When it happensClicking a link, typing a URL, using a bookmark.Submitting a form declared with method="post".
Where data goesIn the query string, visible in the URL.In the request body, not shown in the URL.
ConsequencesBookmarkable, cacheable, appears in history and server logs; length-limited (see 414).Not bookmarkable, not length-limited in the same way, re-submits on refresh.

The other methods the slides name but do not cover are HEAD, CONNECT, TRACE and OPTIONS. You meet PUT and DELETE properly in chapter 7.

Status codes

The first digit gives the family: 2xx success, 3xx redirection, 4xx client error, 5xx server error.

CodeNameWhat it actually means
200OKThe request was successful.
301Moved PermanentlyThe requested resource has permanently moved.
304Not ModifiedWith appropriate Cache-Control headers, the server says its copy is no newer than the one in the client cache.
401UnauthorizedThe resource is protected and requires credentials.
404Not FoundThe requested resource was not found. The one code end users recognise.
414Request URI Too LongToo much data is being submitted through the URL — i.e. a GET that should have been a POST.
500Internal Server ErrorThe server hit an error and tells the client almost nothing about it.
Hook for 414: it is the code that proves the GET/POST rule. If you push form data through the URL and it is large, the server refuses with 414. That is the exam-ready justification for using POST.

How a page actually loads

The browser requests the initial HTML page, parses it to find every referenced resource — images, style sheets, scripts — and requests those too. The page is only fully loaded once all the files have been retrieved. The whole set of algorithms to download, parse, lay out, fetch assets and produce the final interactive page is collectively called rendering. Remember this: it is the reason chapter 4 tells you where to put your <script> tag, and the reason chapter 5 uses DOMContentLoaded.

The application stack

Slide 57 defines a web server as "nothing more than a process that responds to HTTP requests", and lists the five parts of an application stack. This is a preview of your whole semester:

Stack layerWhere you meet it in SE371
Operating systemAssumed — not assessed
Web server softwareChapter 6 — Node’s http module and Express
DatabaseChapter 7 — MongoDB/Mongoose and MySQL/Sequelize
Backend language and runtimeChapter 6 — JavaScript on Node.js
Front-end languages/frameworks/librariesChapters 2–5 — HTML, CSS, JavaScript, the DOM

How to make an all-theory chapter stick

You cannot code your way through chapter 1, but you can observe everything in it in about fifteen minutes. Reading the slides again is the worst use of your time; doing this instead is the best.

1. Watch a real request/response pair

Open any site → DevTools (F12) → Network tab → reload. Click the first document row. You are now looking at exactly what slides 49–55 describe: the request method, the request headers, the status code, and the response headers. Find Host, User-Agent, Server, Content-Type and Last-Modified with your own eyes once and you will not forget which side each belongs to.

2. Count the requests

Still in the Network tab, look at the request count at the bottom. That number is slide 56 — the browser fetched the HTML, parsed it, and then fetched every stylesheet, script and image it referenced. Sort by Type to see the categories.

3. Trigger the status codes yourself

Terminal — see the codes from slide 55-I sends a HEAD request: headers only, no body
curl -I https://example.com                 # 200 OK, plus every response header
curl -I https://example.com/no-such-page    # 404 Not Found
curl -I http://github.com                   # 301 Moved Permanently → https
curl -I https://httpbin.org/status/500      # 500 Internal Server Error
curl -I https://httpbin.org/status/401      # 401 Unauthorized

4. Do a DNS lookup by hand

Terminal — slides 43–44, livedig +trace prints the ten steps as they happen
nslookup psu.edu.sa          # name → IP, exactly what step 9 returns
dig +trace psu.edu.sa        # the whole chain: root → TLD → authoritative
ping psu.edu.sa              # shows the resolved IP before the first reply

The +trace output is the ten-step diagram, printed live. Run it once and the diagram stops being something you memorised and becomes something you watched.

5. Prove GET puts data in the URL

Search for something on any site and read the address bar. The ?, the key=value pairs and the & separators from slide 48 are right there. Change a value in the URL and press Enter — the page responds to your edit. That is why slide 65 of chapter 2 will tell you client-side validation is not security.

The five things people get wrong

“The Internet and the Web are the same thing”

They are not, and slide 5 opens with the distinction specifically so it can be tested. The Internet is the network of networks; the Web is one application-layer service running on it, alongside email, FTP and SSH.

Fix: The Web needs the Internet. The Internet does not need the Web.

Putting DNS under TCP

DNS is an application layer protocol, listed on slide 33 next to HTTP and FTP. Separately, it is one of the services that runs over UDP, not TCP (slide 32). Both facts get mixed up.

Fix: DNS lives at the application layer and is carried by UDP. Two different questions, two different answers.

Confusing the two "best effort" claims

The Internet layer is the best-effort one — it sends a message, expects no reply, and guarantees nothing. The transport layer is the one that adds guarantees, via TCP. People swap these.

Fix: Internet layer = route it and hope. Transport layer = make sure it got there.

Answering "404" for everything that goes wrong

404 means the resource was not found — a client-side mistake about what was asked for. A crashed server is 500. A missing login is 401. A too-long query string is 414. A cached copy still being valid is 304.

Fix: Read the first digit first: 4xx is your fault, 5xx is the server’s fault.

Saying POST is "secure"

POST only moves the data from the URL into the request body. Over plain HTTP it is still readable on the wire, and anyone can open DevTools and read or change it before sending.

Fix: POST is about where the data goes and how much of it fits, not about security. HTTPS is what makes it private.

Chapter 1 on a single screen

Four layers (top → bottom)

  • Application — HTTP, SSH, FTP, SMTP/POP/IMAP, DNS
  • Transport — TCP (ordered, ACKed), UDP (no guarantee)
  • Internet — IP routing, best effort
  • Link — physical media, MAC addresses

Status codes

  • 2xx success · 3xx redirect
  • 4xx client error · 5xx server error
  • 200 OK · 301 Moved Permanently
  • 304 Not Modified · 401 Unauthorized
  • 404 Not Found · 414 URI Too Long
  • 500 Internal Server Error

URL parts

  • protocol — required
  • domain or IP — required
  • :port — optional, HTTP defaults to 80
  • /path — optional, maps to a server folder
  • ?k=v&k=v — query string

DNS chain

  • local cache → primary DNS
  • → root name server
  • → TLD server
  • → authoritative server
  • → IP returned, real request sent

TLD categories

  • gTLD unrestricted: .com .net .org .info
  • gTLD sponsored: .gov .mil .edu
  • gTLD new: since June 2012, 1000+
  • ccTLD: per-country rules, e.g. .sa
  • .arpa: reverse DNS lookups

Dates worth knowing

  • 1960s ARPANET · 1974 X.25
  • 1979 USENET · 1981 TCP/IP introduced
  • 1 Jan 1983 TCP/IP across ARPANET
  • 1992 Berners-Lee publishes the web
  • 2011 IPv4 space depleted

Close the slides and answer these out loud

  1. Name the four layers bottom to top, and give one job for each.
  2. A packet arrives out of order. Which layer fixes it, and by what mechanism?
  3. Give three services that use UDP and say why guaranteed delivery is not worth its cost for them.
  4. Write out a URL that uses all six parts, then label each one and say which two are required.
  5. List the ten steps of address resolution without looking. Check yourself with dig +trace.
  6. Name the three subtypes of gTLD and give two examples of each.
  7. Give four HTTP status codes from four different families and say what each one tells the client.
  8. Explain why submitting a long form with GET can produce a 414, and what to do instead.
  9. List four request headers and four response headers, and say which side sends each.
  10. Describe what the browser does between receiving the HTML and finishing the page load.
  11. Name the five layers of an application stack and say which SE371 chapter covers each.
  12. State the difference between the Internet and the WWW in one sentence.

Can you answer these without scrolling up?

Question 1