Web and Mobile Application Development (Web与移动应用开发)
Domain 4 covers the front-end/back-end contract, session handling, mobile delivery choices, and payment integration. Questions are practical: which status code, where validation happens, which mobile form fits the requirement.
Web fundamentals
HTML structures, CSS lays out, JavaScript behaves. Responsive design needs the viewport meta tag plus media queries; mobile sizing commonly uses rem or vw. HTTP methods: GET safe and idempotent, POST creates, PUT replaces idempotently, DELETE removes. Status codes you must know: 200, 301/302, 304, 400, 401 vs 403, 404, 409, 500, 502/504.
Session and separation
Cookie (client, small, domain-scoped), Session (server, needs shared store), Token/JWT (stateless, needs expiry and revocation strategy). In 前后端分离 the browser talks to APIs via AJAX/fetch; enable CORS explicitly. All price, stock and permission checks happen server-side - the front end validates only for user experience.
Mobile delivery
Native app (best performance, store distribution), H5/Web app (instant update, weaker capability), hybrid with a WebView bridge, and mini-programs (platform-hosted, no install). Choose by requirement: payment and camera push you native or hybrid; fast campaign pages favour H5.
Worked example
Requirement: an order must never be paid twice when the payment gateway sends duplicate callbacks. Reasoning: create a unique order number, persist a payment state machine (待支付 → 支付中 → 已支付 → 已发货) and accept only legal transitions; verify the gateway signature first; store the gateway transaction id under a unique index; make the callback handler idempotent so a repeated notification returns success without re-processing. Retries are normal, so idempotency is a design requirement, not a defensive extra.
Traps that cost marks
- Trusting client-side price or role checks.
- Handling payment callbacks without signature verification or idempotency.
- Using server-side sessions behind a stateless API gateway without a shared store.
- Omitting the viewport meta tag and then wondering why mobile layout breaks.
- Confusing 401 (not authenticated) with 403 (authenticated but not permitted).