Exercise: Common Misconceptions and the Web Architecture Decision Guide

Build the mental model

This closing lesson does two things: it corrects common misconceptions about the web, then hands you a Web Architecture Decision Guide -- a table of common needs mapped to reasonable starting points, meant to be referenced later rather than memorized now.

• Treating two related things as identical (Internet/Web, session/cookie, authentication/authorization)
• Mistaking one piece for the whole system (a website is 'just HTML', backend is 'just the database')
• Turning a tradeoff into a false absolute ('X is always better than Y')

MYTH VS REALITY
---------------
MYTH:      Internet = Web
REALITY:   Internet contains Web, Email, Messaging, Games, ...

MYTH:      HTTPS = 100% secure
REALITY:   HTTPS = encrypted transport only, one layer of many

MYTH:      Logged in = Authorized for everything
REALITY:   Authentication (who you are)
           != Authorization (what you can do)

Connect it to a real scenario

Here are the misconceptions worth unlearning early, gathered from across this entire course. Each one sounds reasonable on the surface, which is exactly why it spreads -- the correction restores the detail the shortcut left out.

• "Internet and Web are the same thing" -- False: the Internet is the physical/network infrastructure connecting devices worldwide; the Web is just one service built on top of it, alongside email, messaging, and online gaming.
• "A website is just an HTML file" -- False: most real sites also need a server, a database, APIs, and authentication working behind that HTML.
• "Frontend is just CSS" -- False: frontend covers layout, styling, and application behavior -- the interactive logic users click through, not just visual styling.
• "Backend is just the database" -- False: backend also handles business logic, authentication, API endpoints, and file handling; the database is only one piece it talks to.
• "Domain and hosting are the same thing" -- False: a domain is a name you register; hosting is the server space where your site's files actually live -- you need both, often from different providers.
• "DNS provides hosting" -- False: DNS only points a domain name to the correct server address; it never stores or serves the site's files itself.
• "HTTPS means 100% secure" -- False: HTTPS encrypts the connection between browser and server, but it does nothing against weak passwords, phishing, or bugs in the application itself.
• "All cookies are tracking cookies" -- False: many cookies exist purely to keep you logged in, remember cart items, or store preferences, with no tracking purpose at all.
• "A session is just a cookie" -- Not quite: a session is server-side state; the cookie usually just carries a reference ID pointing back to that state.
• "Being logged in means you're authorized for everything" -- False: authentication confirms who you are, while authorization separately decides what you're allowed to do -- being logged in doesn't grant every permission.
• "REST API and backend are the same thing" -- False: an API is the interface a backend exposes; the backend is the broader system of logic, data, and services behind that interface.
• "GraphQL is always better than REST" -- False: GraphQL suits flexible, nested data needs well; REST is often simpler and sufficient for straightforward CRUD-style APIs.
• "SSR is always faster than CSR" -- False: SSR can shorten first paint, but a slow server or heavy per-request work can make it slower overall than a well-cached CSR app.
• "Using WebSocket means you don't need HTTP anymore" -- False: WebSocket connections are typically negotiated through an initial HTTP handshake, and most apps still use HTTP for everything that isn't real-time.
• "A PWA is the same as a native app" -- False: a PWA is a web app with app-like features (installable, offline-capable); it still runs inside a browser engine rather than compiling to the full native platform.

• Most web misconceptions come from collapsing two related things into one, mistaking a piece for the whole system, or turning a tradeoff into a false absolute.
• Authentication, authorization, sessions, and cookies are frequently confused pairs -- each half plays a genuinely distinct role.
• The Web Architecture Decision Guide gives reasonable starting points for common needs, not fixed rules every project must follow.

Try the working example

const misconceptionLookup = {
  "internet-is-web":
    "False. The Internet is the network of connected computers; the Web is one service that runs on it, alongside email, messaging, and gaming.",
  "website-is-html-file":
    "False. Most real sites also need a server, a database, APIs, and authentication behind that HTML.",
  "https-is-100-percent-secure":
    "False. HTTPS encrypts the connection; it does not stop weak passwords, phishing, or bugs in the app itself.",
  "logged-in-means-authorized":
    "False. Authentication proves who you are; authorization decides what you are allowed to do next.",
  "graphql-always-better-than-rest":
    "False. GraphQL suits flexible, nested data needs; REST is often simpler for straightforward CRUD APIs.",
  "ssr-always-faster-than-csr":
    "False. SSR can shorten first paint, but a slow server or heavy per-request work can make it slower overall.",
  "pwa-is-same-as-native-app":
    "False. A PWA is a web app with app-like features; it still runs in a browser engine, not the full native platform."
};

function explainMisconceptions(keys) {
  return keys.map((key) => {
    const explanation = misconceptionLookup[key];
    return explanation
      ? `${key}: ${explanation}`
      : `${key}: no explanation on file yet`;
  });
}

const toCheck = [
  "internet-is-web",
  "https-is-100-percent-secure",
  "logged-in-means-authorized",
  "ssr-always-faster-than-csr"
];

for (const line of explainMisconceptions(toCheck)) {
  console.log(line);
}

internet-is-web: False. The Internet is the network of connected computers; the Web is one service that runs on it, alongside email, messaging, and gaming.
https-is-100-percent-secure: False. HTTPS encrypts the connection; it does not stop weak passwords, phishing, or bugs in the app itself.
logged-in-means-authorized: False. Authentication proves who you are; authorization decides what you are allowed to do next.
ssr-always-faster-than-csr: False. SSR can shorten first paint, but a slow server or heavy per-request work can make it slower overall.

MDN Web Docs -- How the Web Works — How the Web Works

Web Development Glossary — Common Terms

Web Architecture Decision Guide