In today's scenario, web application security depends upon two primary surfaces--the web application itself and the platform on which it is deployed. You can separate these two surfaces, as any web application cannot be deployed with a platform.
Network security versus application security
The web application stack
It is very important to understand the distinction between a platform and an application because of the impact it has on security. A typical web application would have an architecture similar to the one depicted in the following diagram:
Most web applications depend on web servers, such as Apache/HTTP server, Rails, nginx, and others, which actually handle the incoming request based on the type of application...
