The OSI Model

What it is

The OSI (Open Systems Interconnection) model is a conceptual framework that divides network communication into seven layers. It was never implemented as-is - the internet runs on TCP/IP, which doesn't map cleanly onto it - but OSI is still the standard vocabulary for talking about where in the stack something operates.

As a web developer the model matters because security controls live at specific layers, and understanding which layer something protects (or doesn't) tells you what it can and can't defend against.

The seven layers

Where TLS actually sits

TLS is nominally Layer 6 (Presentation) in OSI terms, but the TCP/IP model that the internet actually uses doesn't have a Presentation layer. In practice TLS sits between TCP (Layer 4) and HTTP (Layer 7) - it operates on top of a reliable transport connection and below application data. This is why it's called Transport Layer Security despite sitting above the transport layer in OSI terms: the name comes from the TCP/IP framing, not OSI.

HTTP          ← application data (your request/response)
  └─ TLS      ← encrypts and authenticates
      └─ TCP  ← reliable byte stream
          └─ IP ← packet routing

Why this matters for security

Each layer can only protect what it knows about. A firewall at Layer 3/4 blocks IPs and ports but can't read HTTP - it doesn't know what URL was requested. A WAF (Web Application Firewall) operates at Layer 7 and can inspect HTTP content but only after TLS has been terminated somewhere it can see plaintext.

• TLS (L6) - encrypts the channel. Protects against network-level eavesdropping and tampering. Does nothing about what your application does with data once it arrives.
• Firewalls (L3/4) - block unwanted traffic by IP/port. No visibility into HTTP content.
• WAFs (L7) - inspect HTTP. Can block SQLi/XSS patterns in requests, but require TLS termination first.
• Application code (L7) - the last line. CSRF tokens, input validation, auth checks - all here.

Most of what a developer writes lives at Layer 7. TLS is infrastructure - you configure it, you don't implement it. But knowing it exists at a separate layer explains why HTTPS doesn't protect you from XSS, SQLi, or broken auth - those are Layer 7 problems.

TCP/IP vs OSI

The internet uses the four-layer TCP/IP model, not OSI. The mapping is approximate:

OSI is the vocabulary. TCP/IP is what runs. You'll encounter both in documentation and conversations - knowing they don't map exactly saves confusion.