Web and Mobile Application Development
What this domain tests
Web and Mobile Application Development tests how client, server, and mobile layers communicate and where security belongs. Expect HTML/CSS/JavaScript, DOM events, HTTP methods and status codes, REST, responsive design, and mobile state.
Core rules and concepts
- Semantic HTML gives structure and accessibility; CSS box model is content, padding, border, margin. Media queries and a viewport meta tag support responsive layouts.
- JavaScript manipulates the DOM and handles events. Client-side validation improves UX but is bypassable; the server must validate again.
- REST maps resources to URLs. GET reads, POST creates, PUT/PATCH update, DELETE removes. 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Server Error.
- Mobile apps have lifecycle states; save UI state before backgrounding and release resources when stopped.
- CORS controls browser cross-origin reads; it is not a substitute for authentication.
Worked example
A signup form checks the email format in JavaScript, then sends POST /api/users. If valid, the server returns 201 Created with a Location header; if the JSON is malformed, it returns 400; if the caller is not authenticated, 401. The client check is only convenience-an attacker can call the API directly-so the server repeats format, uniqueness, and authorization checks.
Traps that cost marks
Treating client-side validation as a security control. Using GET for state-changing operations. Storing secrets in JavaScript or local storage. Returning 200 for every error. Forgetting labels, alt text, and keyboard access.