What is a 3-tier web application, and why do most web applications today count as n-tier?

A 3-tier application separates the web server, which holds the code for building pages and the logic, from the database; the web browser counts as the third, presentation tier. Modern, service-oriented applications have many more layers and services, so they no longer fit three tiers and are called n-tier (multi-tier) applications.

* Browser, web server and database: three tiers, two of them on the operator's side. *

The tiers matter for security architecture because each tier is a natural boundary. The browser runs on the user's device and is never trusted. The web/application tier talks to the browser and to the data tier. The data tier only needs to talk to the application tier. Once the application is layered like this, the DMZ can be layered the same way, which is the subject of the next card.

Go deeper:

• Multitier architecture — Wikipedia — presentation, logic and data tiers and how n-tier generalises them.