Backend
- Standard term
The backend is the part of an app that runs out of visitors' reach, usually on a server, where it checks permissions, saves and reads data, runs scheduled jobs, and uses private keys.
Anything a browser receives, the person using it can read and edit with tools built into every browser, and they can send the server any request they like. Code on the server runs as written whatever a visitor tries, so a rule only holds when the server applies it.
Where you’ll meet it
Your tutoring business's booking page emails each customer a confirmation, set up by following a quick-start example you found online. It works on the first try. Then, looking through the page's code in your browser, you find the email service's secret key, where any visitor could copy it and send mail as you.
What to do
- Have the agent send email from the backend, with the key in your host's Environment Variables.
- Put a new key from the email service in those settings, and delete the old one.
- After a test booking emails you, search the page's code for the new key.
Easy to mix up
The frontend is everything a visitor sees: the page, its layout, buttons, and forms. Of the backend they see only what it sends back, such as a saved booking or an error message.
Check yourself
Your shop's checkout page adds up the cart in the browser and sends the total to your server, which charges that amount. You learn that a visitor paid $1 for a full cart by editing that total. Which fix holds?
Go deeperBackend code can still hand secrets to the browser
A backend can run as a long-lived server, as serverless functions that start for each request, or on edge servers near the visitor. Frameworks such as Next.js keep browser and server code in one project and send a setting to the browser only when its name carries a public prefix. A secret key given that prefix ships to every visitor.
Responses leak too. An error page showing the server's internals, or a reply that returns an entire database row when the page needed one field, can deliver a secret or another person's data. Reviewers read backend code for what it sends out as closely as for what it lets in.