
The SAP Front-End Server is an ABAP Stack like any SAP ERP or SAP S/4HANA Back-End Server. However, no business add-ons are installed out of the box.
The recommended SAP Fiori system landscape splits up the UI part from the business logic on SAP Back-End Server.
- Lifecycle decoupling of UI apps from back-end.
- Especially for apps that must also run on any DB.
- Allow faster iterations for the UI apps.
- Allow changes to UI without the need for development privileges in the back-end.
- Add-on-based delivery enables fast release cycles.
- Single point of UI maintenance like browser support or UI5 provisioning.
- Central place for themes and brands.
- Single place for configuration, personalization and SAP Fiori shell services.
- Rule-based dispatching of requests in a multi-system landscape (for example for approvals including aggregation).
- Security considerations.
- Similar to an application-level gateway (ALG) with protocol switch and white-listing (excluding search).
- Admin for UI metadata does not need to have admin rights in the back end (data sensitivity).
Note that this picture does not describe the whole SAP Fiori architecture. It just shows the relevant components from an authorization point of view

This is the big picture of the SAP Fiori system landscape (simplified with important components for authorization)

SAP Fiori Launchpad Search works differently. The search user interface is called via HTTP / HTTPS from the central UI component on the Front-End Server, as it is part of the SAP Fiori Launchpad. But the data comes through thecl directly from the enterprise search engine on the SAP S/4HANA Back-End Server. (InA protocol is an internal protocol used by SAP products to retrieve data from (embedded)SAP BW systems or SAP HANA databases)

SAP legacy apps such as Web Dynpro or GUI for HTML apps need a HTTP or HTTPS connection that connects directly to the Back-End Server.
The pre-delivered Tiles, Spaces and Pages, Groups and Catalogs are shipped with the product UI and accessed via HTTP / HTTPS as well, or it is shipped via remote catalogs, spaces and pages, and groups on the SAP S/4HANA Back-End Server.