I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration:
Web server -> Application server -> Database, than this:
Web server -> Database
The reasons that if an adversary takes control of a web server, then there is one more layer to overcome if you need the database.
I think that if an adversary controls the web server then they are as good as having full access to the database, since they will be able to execute arbitrary requests to the application server that will trust them. It will slow them down I guess, but the extra effort to implement a middle tier + all possible holes in the application introduced by that seems not to be worth the effort to me.
P.S. Since I was told that my question is to generic, I will add more information on the setup that I have.
I have a SPA client that talks only to the API and token is used as an authentication scheme. Web application really provides only the initial request to hook up the application and there are no other calls apart from static files and API. The web application then talks directly to the database in the Data Layer. I have just one user in the database and all access is controlled by the business logic and/or the authorization layer in my framework (e.g. roles in a token can be verified with attributes before it goes to business layer, so without a required role you are not allowed to access some API at all). So there is not danger in anyone calling any of the API (unless I fail in protecting them appropriately, but that's another story).
So taking into account this setup, would there be any advantage from security point of view to make web application's data layer to talk to the application server that will handle the business logic instead of the database directly (and the application server will talk to the database). In this case the web application is generally reduced to the initial loading of the client + a proxy to the application service, which seems quite superfluous to me.