The big picture
An end-to-end map of a request
From the browser to the database and back: the stops, their duties and where time can be lost.
Understand the concept
When you open a blog post the request passes through five zones. On the client the browser prepares the request and the network layer builds a secure connection with DNS, TCP and TLS. At the edge a reverse proxy terminates TLS and forwards the request to the private network. On the web server Next.js needs data to render the page and calls the API. In the API, ASP.NET Core runs the request through a middleware pipeline: exception handling, routing, rate limiting, authentication, authorization, model binding and finally the controller. In the data zone the cache is checked first; on a miss EF Core translates the query to SQL and SQL Server executes it.
The response travels back the same way and every stop adds something: EF Core turns rows into objects, the controller produces JSON, Next.js produces HTML, the proxy compresses it, the browser paints it and makes the page interactive.
The goal is not to memorise the map but to be able to ask ‘which stop?’ when something goes wrong. Try the scenarios in the simulator below: a cached request, an unauthorised request or a database failure. Some stops never run; seeing where a request short-circuits explains why the layers exist.
Performance work and debugging begin with knowing which stop consumes the time.
Always blaming the database for a slow page; often it is the network, heavy JavaScript or repeated calls.
A letter’s journey through the city
Think of a request as a letter and the server as a city. Pick a scenario, press play and watch which gates the letter passes and where it gets stopped.
You clicked a post. The browser writes a letter saying ‘send me this post’.
One topic. Three levels of depth.
Tarayıcı → Ağ → Ters vekil → Next.js → API → (Redis | EF Core → SQL Server)
← ← ← ← ← ← ← ← ←The outbound and return paths cross the same stops.
This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.
Try it yourself first.
Run the ‘Unauthorised request’ scenario in the simulator. Which stops never run, and why is that good?
Show the solution and explanation
Çalışmayanlar: model binding, controller, servis, Redis, EF Core, SQL Server.
İstek yetkilendirme middleware’inde 401 ile kısa devre yapar.The earlier a doomed request stops, the fewer resources it consumes and the smaller the attack surface.