What happens when you open a web page

From typing a URL to seeing the page: DNS, TCP, TLS, the HTTP request, the app and the database.

The idea

A page load is a chain: the browser resolves the name with DNS, opens a TCP connection, secures it with TLS, sends an HTTP request with method, path, headers and cookies, and the server routes it to code that may query a database before sending back a status code, headers and a body.

Code

// Server side of one request in ASP.NET Core
app.MapGet("/api/profile", async (HttpContext ctx, AppDb db) =>
{
    var user = ctx.User.Identity?.Name;
    if (user is null) return Results.Unauthorized();
    var profile = await db.Profiles.FindAsync(user);
    return Results.Ok(profile);
});
// Browser:  GET /api/profile HTTP/1.1
//           Host: example.com  Cookie: session=...

Tips

• Know the status families: 2xx success, 3xx redirect, 4xx client error (401 not signed in, 403 not allowed, 404 not found), 5xx server error.
• Cookies ride along on every request to their site, which is why session cookies need the Secure, HttpOnly and SameSite flags.
• Every hop is a place to defend: TLS on the wire, auth checks in the app, least privilege at the database.

In the .NET library

Kestrel receives the request, middleware runs in order (HTTPS redirection, authentication, authorization), then the endpoint runs.