We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this:
Some will have another firewall between the application server and the database (which would be on the internal network).
Question being with today's highly interactive pages where a lot of the logic is in javascript how would this work? Javascript generally needs to receive json. I would guess in this structure that the web server can't communicate directly with the database server. So you would have to go through the application server. That's all fine an dandy when your pages are static and the only code that will be communicating with the app server will be the web server but generally javascript will need to communicate with the app server (which in our case will be REST services). I'm also assuming in this structure the only thing that can communicate with the application server is the web server.