> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/thick-and-thin-client/web-app-vs-thin-client.md).

# Web App vs Thin Client

A **Web Application** refers to **the type of application**—software that users access through a web browser using HTTP/HTTPS.

A **Thin Client** refers to **the application architecture**—an architecture where most of the processing and business logic are performed on a remote server, while the client primarily displays the user interface and sends user input.

* **Web Application** = *What the application is.*
* **Thin Client** = *How the application works.*

However, **not all thin clients are web applications**. Technologies such as **Citrix Workspace**, **Microsoft Remote Desktop (RDP)**, and **VMware Horizon** are also thin clients because the applications run on remote servers, even though they are not browser-based web applications.

***

#### Comparison

| Feature       | Web Application                                 | Thin Client                                                                         |
| ------------- | ----------------------------------------------- | ----------------------------------------------------------------------------------- |
| Definition    | A browser-based application                     | A client-server architecture where most processing occurs on the server             |
| Access Method | Web browser                                     | Browser, Citrix, RDP, VDI, or other lightweight client                              |
| Protocols     | HTTP/HTTPS                                      | HTTP/HTTPS, RDP, ICA, PCoIP, and others                                             |
| Installation  | Usually no installation required (browser only) | May use a browser or an installed client such as Citrix Workspace or Remote Desktop |
| Examples      | Gmail, GitHub, Jira, Banking Portal             | Web applications, Citrix-hosted applications, RDP sessions, VMware Horizon          |

#### Testing Perspective

* If the target is a **browser-based application**, it is typically referred to as a **Web Application Penetration Test**.
* If the target is an application delivered through **Citrix, RDP, or VDI**, it is typically referred to as a **Thin Client Penetration Test**.
* If the thin client is a web application, then **Thin Client Penetration Testing** and **Web Application Penetration Testing** are effectively the same assessment.