Differences between Web server and Application Server ? Why we need both?

1) Application Security: Web Server host machine is usually connected to internet, where as Application Server is usually not. 


         Application Server has the business logic which might be vulnerable if it is exposed 
         in internet. Generally Servlets, EJB's are stored in Application Server. Only static 
         content is hosted on web server machine like HTML and few scrips like JSP.

          Only Web Server can forward the requests and receive the requests from the 
          Application Server.

2) User Security: User request comes from HTTP Server to Application Server and sent back to HTTP Server with a JSESSIONID.

           Session state is maintained as normal, your Java webapp on the app server sends 
           the user  back a cookie containing a JSESSIONID and when the user makes 
           subsequent requests, Apache includes all request info (including cookies) in what it 
           forwards to the app server

3) Performance: Web Server is a faster and lighter application in general than the Application Server. 

          The most common example for this is that Apache HTTP Server is based on C and 
           Tomcat is based  on Java.

4) Scalability: In a Load balance situations, Web Server might act like a Load balancer and forward requests to multiple Application Servers. And there might be a hardware load balancer if you need multiple Web Servers.

          
          Web Server like Apache sit in front of  application server and load balance requests 
          to multiple  application servers like JBoss instances, it's still pretty easy to set up 
          with mod_proxy_balancer.