Web Developer Dictionary

A WAF (Web Application Firewall) is an application-layer (L7) firewall that analyses HTTP traffic and blocks malicious requests before they reach the application. Protects against SQL injection, XSS, CSRF, HTTP-level DDoS, and other OWASP Top 10 attacks. Operating modes Detection mode — logs suspicious requests but does not block them. For initial tuning Prevention mode — actively blocks attacks Types Network-based — hardware appliance in front of servers Host-based — a module on the server (ModSecurity for Nginx/Apache) Cloud-based — Cloudflare WAF, AWS WAF, Fastly. Easiest to set up Limitations A WAF is not a replacement for secure code — it is an additional layer of protection. False positives (blocking legitimate requests) require careful rule tuning.

Web Components are a set of native browser APIs for creating custom HTML elements with encapsulated logic and styles — no framework, pure JavaScript. Three technologies Custom Elements — register a custom tag: <my-button> Shadow DOM — an isolated DOM tree with its own styles that do not leak out HTML Templates — <template> and <slot> for content projection Example class MyCard extends HTMLElement { connectedCallback() { const shadow = this.attachShadow({ mode: 'open' }); shadow.innerHTML = ` .card { border: 1px solid #ddd; padding: 16px; } `; } } customElements.define('my-card', MyCard); // Usage in HTML: // Content here Web Components vs React/Vue Web Components are a native standard with no dependencies. React/Vue are libraries with better DX and ecosystem. They can be combined: Lit (Google) simplifies writing Web Components.

Web performance is the speed at which a web page loads and responds. It directly affects conversion: every extra second of delay reduces conversions by ~7%. Google uses Core Web Vitals in its ranking algorithm.Core Web Vitals (Google)LCP (Largest Contentful Paint) — time to render the largest element. Target: < 2.5 sINP (Interaction to Next Paint) — response time to user interaction. Target: < 200 msCLS (Cumulative Layout Shift) — total layout shift score. Target: < 0.1Key optimisationsCDN for static assetsCompression: Brotli/gzip for text resourcesLazy loading for images (loading="lazy")CSS/JS minification and code splittingHTTP/2 or HTTP/3Server-side rendering or static generation for first paint

A webhook is a push-notification mechanism between services: instead of constantly asking "any news?" (polling), an external service sends an HTTP POST request to your URL when an event occurs. More efficient and simpler than polling.ExamplesStripe sends payment.succeeded to your endpoint — you activate a subscriptionGitHub sends a push event — your CI triggers a buildThe Telegram Bot API sends a new message to your webhook URLSecurityThe external service signs the request body with a secret key (HMAC-SHA256). Your handler verifies the signature before taking any action — to confirm the request genuinely came from the trusted source, not an attacker.ReliabilityA webhook handler must respond quickly (200 OK) and push real work to a queue — otherwise the external service may consider delivery failed and retry the request.

WebSocket is a full-duplex communication protocol between a browser and server over TCP. Unlike HTTP — where the client always initiates a request — WebSocket lets the server push data to the client at any moment. Ideal for chats, online games, and live dashboards.How the connection is establishedIt starts as a regular HTTP request with an Upgrade: websocket header. The server confirms the upgrade — and the TCP connection remains open. Both sides can send messages at any time, with no overhead of a new HTTP request.AlternativesSSE (Server-Sent Events) — a one-way stream from server to client, simpler to implementLong polling — the client waits for a server response, then immediately makes a new request. An older approachServer-side librariesNode.js: Socket.io, ws. PHP: Ratchet, Swoole, ReactPHP. Go: gorilla/websocket. Python: websockets, FastAPI WebSocket. In production, a dedicated WebSocket server is often run alongside the main HTTP application.