Web Systems II

Course Description

Web Systems II covers advanced web development with server-side technology, focused on .NET. Students develop, test, and deploy database-driven websites using cloud-based servers and .NET publishing standards with code management, and a complete full-stack development project is a course requirement.

Within the SCNS taxonomy, COP is the Computer Programming prefix, and the 4000-level number places this in the upper division. Daytona State publishes it at 3 credits, prerequisite COP4813, offered spring, giving approximately 45 contact hours consistent with the published COP4813 and COP4610.

The step this course represents is from writing code to shipping a system. A client-side application runs on the developer's machine; a database-driven site deployed to a cloud server has to handle real requests, persist data reliably, authenticate users, survive being on the public internet, and be deployable repeatably. Those concerns are what separate a programmer from a developer.

Learning Outcomes

Required Outcomes

• Describe web application architecture and the division of responsibility between client and server.
• Describe the request-response cycle, HTTP methods, status codes, and headers.
• Build server-side applications using a .NET web framework.
• Apply the model-view-controller or comparable architectural pattern.
• Implement routing, controllers, and views or endpoints.
• Design a relational database schema appropriate to an application's requirements.
• Access and manipulate data using an object-relational mapper and raw queries as appropriate.
• Implement create, read, update, and delete operations against persistent storage.
• Design and consume web APIs, including RESTful services and JSON payloads.
• Implement authentication and authorization, including role-based access.
• Manage sessions, cookies, and application state securely.
• Validate input on both client and server and handle errors gracefully.
• Apply secure coding practices against common web vulnerabilities.
• Manage configuration and secrets appropriately across environments.
• Use version control effectively, including branching and meaningful commits.
• Test application components and describe unit and integration testing.
• Deploy an application to a cloud-hosted environment.
• Describe build and deployment pipelines and publishing standards.
• Apply logging, monitoring, and diagnostics to a deployed application.
• Describe performance considerations, including caching and query efficiency.
• Plan, build, document, and present a complete full-stack project.

Optional Outcomes

• Describe containerization and its role in deployment.
• Describe continuous integration and continuous deployment.
• Describe microservice architecture and its trade-offs.
• Integrate third-party services and external APIs.
• Describe accessibility requirements for web applications.
• Describe scaling, load balancing, and availability.

Major Topics

Required Topics

• Web application architecture
• HTTP and the request-response cycle
• .NET server-side framework fundamentals
• MVC and architectural patterns
• Routing, controllers, and views
• Relational schema design
• Object-relational mapping and data access
• CRUD operations and persistence
• Web APIs, REST, and JSON
• Authentication and authorization
• Sessions, cookies, and state
• Input validation and error handling
• Secure coding against common vulnerabilities
• Configuration and secrets management
• Version control and code management
• Testing
• Cloud deployment
• Build and publishing pipelines
• Logging, monitoring, and diagnostics
• Performance and caching
• The full-stack project

Optional Topics

• Containerization
• CI/CD
• Microservices
• Third-party integration
• Web accessibility
• Scaling and availability

Resources & Tools

• Microsoft Learn (learn.microsoft.com) — free, official, current, and better than any textbook for .NET. The ASP.NET Core tutorials are the primary resource for this course.
• .NET SDK and Visual Studio Community or VS Code — all free; Community edition is free for students and individual developers.
• Entity Framework Core documentation — free, and the ORM the course will most likely use.
• SQL Server Express, SQLite, or PostgreSQL — free databases sufficient for any coursework.
• Azure for Students — free credit and free-tier services with a student email; the natural deployment target for a .NET course and worth claiming.
• Git and GitHub — free; GitHub Student Developer Pack bundles genuinely useful free tooling.
• OWASP (owasp.org) — free: the Top Ten and the Cheat Sheet Series. See the security flag below.
• Postman or Thunder Client — free API testing tools; essential once you are building endpoints.
• MDN Web Docs — free and authoritative on HTTP, headers, cookies, and web platform behaviour.
• A domain and a deployed URL — cheap, and a live application is worth more in an interview than a repository.

Career Pathways

• Full-stack developer — the direct destination, and the .NET stack is heavily used in enterprise and government.
• Back-end developer — server-side and API work.
• .NET developer — a well-defined market, particularly in corporate, financial, healthcare, and public-sector environments.
• Web application developer — in-house development teams.
• Software engineer — the general title; this course's system-building experience is what distinguishes candidates.
• DevOps engineer — the deployment and pipeline content is the entry point.
• Cloud developer — Azure certification pairs naturally with a .NET background.
• Database developer.
• Government and defence software — Florida's federal, defence, and space-sector presence uses .NET heavily.
• SOC codes 15-1252 Software Developers and 15-1254 Web Developers. .NET is less fashionable than some stacks and has substantial, stable enterprise demand — which is a good position for a graduate.

Special Information

⚠ You are now writing code that faces the internet — security is not optional

The step-change this course represents, and the reason secure coding belongs in it rather than in a separate elective.

A client-side application can be broken by its user; a deployed server-side application can be broken by anyone. The OWASP Top Ten is the standard reference, and the recurring categories are worth knowing by name:

• Injection. Never build a query by concatenating user input. Parameterized queries and ORMs prevent SQL injection — and note that ORMs do not protect you if you drop to raw SQL and concatenate anyway.
• Broken access control. The most common serious flaw. Checking authorization on every request, server-side, is the fix — hiding a link in the UI is not access control, and neither is trusting an ID supplied by the client.
• Cross-site scripting. Encode output by default; modern frameworks do this unless you explicitly disable it, and disabling it is where the bugs come from.
• Authentication failures. Use the framework's identity system rather than writing your own. Never store passwords in plain text or with a fast hash — use the platform's password hashing, which is designed for it.
• Security misconfiguration. Debug pages in production, default credentials, verbose error messages leaking stack traces, and permissive CORS are all common and all avoidable.
• Secrets in source control. Connection strings and API keys committed to a repository is a classic and consequential mistake — use configuration providers, environment variables, or a secrets store, and add them to `.gitignore` before the first commit rather than after.
• Vulnerable dependencies. Packages carry known vulnerabilities; keep them updated and check advisories.
• Use HTTPS everywhere, and validate on the server regardless of what the client already validated — client-side validation is a usability feature, not a security control.

The framing worth carrying: an application is not finished when it works; it is finished when it works and cannot be trivially abused.

⚠ Deployment is where courses usually stop and jobs begin

The most valuable part of this course's scope, because it is what most graduates have never done.

• "It works on my machine" is the classic failure. Configuration differences, missing dependencies, database connection strings, file paths, and permissions all differ between a laptop and a server.
• Separate configuration from code. Environment-specific settings belong in configuration, not in source, and the same build should run in development and production with different configuration.
• Learn the publish pipeline properly — build, publish, deploy — rather than copying files. Repeatable deployment is what makes releases routine instead of frightening.
• Database migrations matter. Schema changes have to be applied to an existing database with data in it; EF Core migrations exist for that and using them from the start avoids real pain.
• Log usefully. A production application you cannot diagnose is a liability — structured logging with correlation across requests is what makes an incident tractable at 2am.
• Handle errors gracefully in production. Users get a friendly page; you get the stack trace in the logs. Never the reverse.
• Claim Azure for Students. Free credit and free-tier services mean you can deploy a real application at no cost — and a live URL is worth more in an interview than a repository link.

⚠ Learn the architecture; the framework version will change

An honest note about a course tied to a specific technology.

• .NET moves quickly, and the specific APIs, project templates, and idioms taught this term will shift. That is normal and it is not a reason to learn them less carefully.
• The durable knowledge is architectural — separation of concerns, request handling, data access patterns, authentication flows, dependency injection, and the reasons behind them. Those transfer to any server-side framework in any language.
• Read the official documentation. Microsoft Learn is free, current, and authoritative; tutorials found elsewhere are frequently written against older versions and will not run.
• Note the version you are using and be aware that answers found online may target a different one. This is the single most common source of confusion for students in .NET courses.
• Dependency injection is worth understanding properly rather than treating as boilerplate — it is central to how modern .NET applications are structured and tested.
• Async is pervasive in .NET, and understanding why — freeing threads during I/O rather than making things faster — prevents a category of mistakes.

⚠ Build the project as portfolio, and use version control properly from day one

• The full-stack project is the course's real output. It is the artefact you show an employer, and a deployed, working application with a clean repository demonstrates more than any transcript line.
• Choose something with real requirements. A project with actual users — a club, a small business, a campus organization — forces the decisions that a toy project lets you avoid.
• Commit meaningfully and often. A repository with three commits called "update" tells an interviewer something, and it is not good. Small, described commits show how you work.
• Use branches for features, and merge deliberately. This is how teams operate and it is a skill assessed in interviews.
• Write a README. What it does, how to run it, what it is built with, and a screenshot or a live link. Most student repositories have none, and it takes twenty minutes.
• Include tests. Even a handful demonstrates that you know testing exists and how it works — which puts you ahead of most graduates.
• Do not commit secrets, and if you have, rotate them rather than just deleting the file — history persists.

⚠ Only about three Florida institutions carry this number — hedge accordingly

This course appears at roughly three institutions statewide. Content, credit value, and emphasis vary more than they would for a widely taught course. Read your own institution's catalog description and syllabus rather than assuming this guide describes your section exactly, and have any transfer evaluated in writing.

How Florida course levels affect transfer

The first digit of an SCNS number denotes the year of offering, not transferability. Courses at the 1000 and 2000 levels transfer transparently between Florida public institutions, and 3000 to 4000 is unproblematic since both are upper division. The boundary that actually matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement.

COP4834 is 3 credits and approximately 45 contact hours, offered spring. Assessment centres on the full-stack project the catalog requires, with supporting laboratory work; expect substantial time beyond scheduled hours, since building and deploying a complete application is not a timetabled activity.

COP4834 is upper division and sits at the end of a sequence — COP4813 is a genuine prerequisite, not a formality. Students arriving from an A.S. should note that A.S. degrees are applied and do not carry the A.A.'s guaranteed junior-status transfer, though Florida institutions publish B.S. in Information Technology pathways for that population.