The question application server vs web server is quite popular especially at IT interviews and, even if it basically a simple one (after all it's just a matter of saying which services are available on application server and which on web server) it can lead you into the inner details of some well known products such as JBoss application server and Tomcat web server.
So, at first if you have got asked application server vs web server I'd state at first which is the context of our discussion: as a matter of fact while the Web server is often a generic term for a service replying on the HTTP protocol,the term "application server" is often used to refer specifically to application servers that conform to the Java Platform Enterprise Edition (JEE).
Therefore if we want a clear and fair comparison we should compare a Web server and an application server that ae able to deliver applications using the same technologies.
For this purpose we will examine two well-known opensource products, Tomcat Web Server and JBoss application server. The following picture depicts the services which are typically available on JBoss AS:
On the other hand, this is the typical stack of a Tomcat Web server:
Now let's see in detail some core services. Let's start from what they have in common:
JSP/Servlets: Both products contain a Java EE Web container which is capable of delivering Web applications. As side note, you should be aware that Tomcat does not provide JSF out of the box, therefore you have to download and provide them to the container.
EJB: JBoss, as every Java EE application server supports Enterprise Java Beans which are multithreaded transactional components used to develop your business logic. Tomcat, on the other hand, has no embedded EJB container- you can consider using Spring Beans as alternative to code your business logic services.
JNDI: Both Tomcat and JBoss provide a JNDI InitialContext implementation instance where you can lookup services or store entries in it.
JDBC: Both application servers and Web servers typically offer JDBC and Connection pooling services.The resource that wraps the Connection Pool is named datasource and can be acquired by a lookup in the JNDI tree.
JPA: The application server (JBoss) is compliant with JPA and ships with Hibernate as JPA provider. Tomcat does not ship with Hibernate so you have to include it by yourself in your application. Most often Tomcat users turn to Spring JPA which offers comprehensive support for the Java Persistence API in a similar manner to the integration with Hibernate or JDO.
JMS: JBoss application server ships with an embedded JMS Provider (named HornetQ) which can be used to send/receive JMS messages from your applications.Tomcat, on the other hand, does not provide an embedded message queue. If needed, an external message queuing product must be used alongside Tomcat. A number of options are available to you, both open source (for example, ActiveMQ) and commercial.
JTA: The Java Transaction API consists of a high-level application transaction demarcation interface that is available on application server to handle complex transaction scenarios such as distributed transactions across different DBMS. JBoss ships with a full JTA implementations. Tomcat, on the other hand, does not include out-of-the box a transaction manager implementation that supports JTA APIs. You can plug in a third-party external JTA transaction manager (such as Atomikos) to the Tomcat environment to support JTA APIs. Because a third-party JTA transaction manager is an additional component that must be obtained, supported, and possibly licensed, examine the desirability of this approach against the alternative of refactoring code away from the use of JTA.
Web services: JBoss ships both with a SOAP Web services provider (Apache CXF) and a REST Web services provider (RestEasy). Therefore you are able to deploy, out of the box, any kind of Web service on the application server. Technically speaking Apache Tomcat does not ship with a Web service provider of any type (SOAP/REST), yet you don't need any server configuration tweak to get working Web services on Tomcat, you just need to pack the Web service implementation libraries in your application and you go.
Clustering: both application servers and web servers are capable of working in a cluster thus providing load balancing and high availability to your applications. Tomcat offers a replication of data across servers in order to keep in synch the session data, JBoss AS is capable of replicating both the HTTP session layer and the Stateful EJB data across nodes.
Finally, as far as it concerns to Security, both application servers and Web servers are able to secure data transmission using SSL, which is a technology that allows web servers and application servers to communicate over a secured connection. This means that the data being sent is encrypted by one side, transmitted, then decrypted by the other side before processing. This is a two-way process, meaning that both the server AND the browser encrypt all traffic before sending out data. Additionally, both Tomcat and JBoss are capable of running authentication and authorization for your applications using JAAS reals.