Language/Framework Agnostic Web App Development Glossary

Architecture & Design Patterns

Monolith — A single deployable unit containing all application logic (UI, business logic, data access). Simple to develop and deploy early on, but scaling teams/components independently becomes hard.

Microservices — An architecture where an app is split into small, independently deployable services communicating over the network (usually HTTP/gRPC/messaging). Trades operational complexity for independent scaling and deployment.

Monorepo — A single repository housing multiple projects/packages, often with shared tooling and versioning. Contrast with polyrepo (one repo per project).

BFF (Backend for Frontend) — A backend layer tailored to a specific frontend client (web, mobile), aggregating/shaping data from downstream services to fit that client's needs.

API Gateway — A single entry point that routes, authenticates, rate-limits, and aggregates requests to backend services, decoupling clients from internal service topology.

Sidecar Pattern — Deploying a helper process alongside a main service (same host/pod) to handle cross-cutting concerns like logging, proxying, or service mesh networking.

Event-Driven Architecture — Components communicate by producing/consuming events asynchronously rather than direct calls, improving decoupling and scalability.

CQRS (Command Query Responsibility Segregation) — Separating the models/paths used to write data (commands) from those used to read data (queries), often paired with event sourcing.

Event Sourcing — Persisting state as an immutable sequence of events rather than a mutable current state, allowing full history reconstruction and audit trails.

Domain-Driven Design (DDD) — An approach to modeling software around business domains and bounded contexts, aligning code structure with business language.

Hexagonal / Clean Architecture — Architectural styles that isolate core business logic from frameworks, databases, and UI via ports/adapters, improving testability and swappability.

Rendering Strategies

CSR (Client-Side Rendering) — The browser downloads a minimal HTML shell and JavaScript renders the UI client-side. Fast subsequent navigation, slower first paint, weaker SEO by default.

SSR (Server-Side Rendering) — HTML is generated on the server per request and sent fully formed to the browser, improving first paint and SEO at the cost of server load.

SSG (Static Site Generation) — Pages are pre-rendered to static HTML at build time, served via CDN. Fastest delivery, but content is only as fresh as the last build.

ISR (Incremental Static Regeneration) — A hybrid where static pages are regenerated on-demand or on a timer after deployment, without a full rebuild.

Hydration — The process of attaching client-side JavaScript event handlers/state to server-rendered static HTML, turning it into an interactive app.

Islands Architecture — Shipping mostly static HTML with small, independently hydrated interactive "islands," minimizing JS sent to the client.

Networking & APIs

REST (Representational State Transfer) — An architectural style using stateless HTTP requests and standard verbs (GET/POST/PUT/DELETE) against resource-oriented URLs.

GraphQL — A query language/runtime letting clients request exactly the data shape they need from a single endpoint, reducing over/under-fetching versus REST.

gRPC — A high-performance RPC framework using HTTP/2 and Protocol Buffers, common for low-latency service-to-service communication.

Webhook — A server-initiated HTTP callback that pushes data to a client-provided URL when an event occurs, inverting the typical request/response flow.

WebSocket — A protocol providing a persistent, full-duplex connection over a single TCP connection, used for real-time bidirectional communication.

Long Polling / SSE (Server-Sent Events) — Techniques for pushing near-real-time updates over plain HTTP without full WebSocket infrastructure.

Idempotency — A property where repeating the same operation produces the same result as doing it once — critical for safe retries (e.g., PUT, DELETE).

CORS (Cross-Origin Resource Sharing) — A browser security mechanism that restricts/permits cross-origin HTTP requests via server-specified headers.

Rate Limiting — Restricting the number of requests a client can make in a time window, protecting services from abuse or overload.

Circuit Breaker — A resilience pattern that stops calling a failing downstream dependency for a cooldown period, preventing cascading failures.

Reverse Proxy — A server that sits in front of backend services, forwarding client requests to them — used for load balancing, TLS termination, and caching.

Load Balancer — Distributes incoming traffic across multiple service instances to improve availability and throughput.

Data & Persistence

ORM (Object-Relational Mapping) — A library that maps application objects to relational database rows, abstracting raw SQL at the cost of some control/performance.

Connection Pooling — Reusing a fixed set of open database connections across requests instead of opening/closing per request, reducing overhead.

Sharding — Splitting a dataset horizontally across multiple database instances/nodes to scale storage and throughput beyond a single machine.

Replication — Maintaining copies of data across multiple database nodes for redundancy and read scalability (leader/follower or multi-leader).

Eventual Consistency — A consistency model where replicas converge to the same state over time rather than instantly, common in distributed systems.

ACID — Atomicity, Consistency, Isolation, Durability — guarantees provided by traditional relational transactions.

CAP Theorem — States a distributed system can only guarantee two of Consistency, Availability, and Partition tolerance at once.

Migration — A versioned, scripted change to a database schema, applied incrementally and (ideally) reversibly across environments.

Caching

Cache Invalidation — The process of removing or updating stale cached data — famously one of the hardest problems in computer science.

CDN (Content Delivery Network) — A geographically distributed network of edge servers caching static (and sometimes dynamic) content close to users.

Cache-Aside — A pattern where the application checks the cache first, and on a miss, loads from the source of truth and populates the cache.

TTL (Time to Live) — The duration for which a cached item is considered valid before it must be refreshed or discarded.

Stale-While-Revalidate — A caching strategy that serves stale content immediately while asynchronously fetching a fresh copy for next time.

Frontend Engineering

State Management — Patterns/libraries for storing and updating application state predictably, especially state shared across components (e.g., store-based, atom-based, or context-based approaches).

Debouncing — Delaying execution of a function until a pause in triggering events, useful for search inputs or resize handlers.

Throttling — Limiting a function to execute at most once per fixed interval, regardless of how often it's triggered.

Virtual DOM — An in-memory representation of the UI that a framework diffs against the previous version to compute minimal real-DOM updates.

Code Splitting — Breaking a JS bundle into smaller chunks loaded on demand, reducing initial load time.

Tree Shaking — A build-time optimization that removes unused exports/code from the final bundle.

Progressive Enhancement — Building a baseline experience that works without JS/advanced features, then layering on enhancements for capable browsers.

Accessibility (a11y) — Designing/building applications usable by people with disabilities, typically guided by WCAG standards and semantic HTML/ARIA.

Security

Authentication vs. Authorization — Authentication verifies who a user is; authorization determines what they're allowed to do.

JWT (JSON Web Token) — A compact, signed token format for transmitting claims (often used for stateless authentication) between parties.

OAuth 2.0 — An authorization framework allowing third-party applications limited access to a user's resources without exposing credentials.

CSRF (Cross-Site Request Forgery) — An attack tricking an authenticated user's browser into making unwanted requests; mitigated with tokens/SameSite cookies.

XSS (Cross-Site Scripting) — An attack injecting malicious scripts into pages viewed by other users; mitigated via output encoding and CSP.

CSP (Content Security Policy) — An HTTP header restricting which sources of scripts/styles/resources a page is allowed to load, reducing XSS impact.

Zero Trust — A security model that assumes no implicit trust between network zones, requiring verification for every request regardless of origin.

DevOps & Delivery

CI/CD (Continuous Integration / Continuous Delivery-Deployment) — Automated pipelines that build, test, and (optionally) deploy code on every change.

Blue-Green Deployment — Running two identical production environments and switching traffic between them for zero-downtime releases.

Canary Release — Gradually rolling out a change to a small subset of users/traffic before a full rollout, to catch issues early.

Feature Flag — A toggle that enables/disables functionality at runtime without a new deployment, useful for gradual rollouts and experimentation.

Immutable Infrastructure — An approach where servers/containers are never modified in place — changes are deployed by replacing them entirely with new instances.

Observability — The ability to understand a system's internal state from its external outputs, typically via logs, metrics, and traces (the "three pillars").

Idempotent Deployment — A deployment process that can be safely re-run without producing different or harmful results.

Testing

Unit Test — Tests a single function/component in isolation, typically with dependencies mocked/stubbed.

Integration Test — Tests how multiple units/components work together, often including real (or realistic) dependencies like a database.

End-to-End (E2E) Test — Tests a full user flow through the actual running application, simulating real user behavior.

Test Pyramid — A guideline suggesting many fast unit tests, fewer integration tests, and even fewer slow E2E tests.

Mocking / Stubbing — Replacing real dependencies with controlled fake implementations to isolate the code under test.

Contract Testing — Verifying that a service's API matches the expectations ("contract") of its consumers, without full integration tests.

Performance

TTFB (Time to First Byte) — The time between a client request and the first byte of the response arriving — reflects backend/network latency.

Core Web Vitals — Google's metrics (LCP, INP, CLS) for measuring real-world loading, interactivity, and visual stability of a page.

Lazy Loading — Deferring the loading of a resource (image, module, data) until it's actually needed.

N+1 Query Problem — A performance anti-pattern where one query triggers N additional queries (e.g., fetching related records in a loop) instead of a single batched query.

Backpressure — A mechanism for a system to signal upstream producers to slow down when it can't keep up with incoming data/requests.