Foundations of Python Network Programming 978-1-4302-3004-5

CHAPTER 9 ■ HTTP
If the connection works properly, then neither your government nor any of the various large and
shadowy corporations that track such things should be able to easily determine either the search term
you used or the results you viewed.
HTTP Authentication
The HTTP protocol came with a means of authentication that was so poorly thought out and so badly
implemented that it seems to have been almost entirely abandoned. When a server was asked for a page
to which access was restricted, it was supposed to return a response code:
HTTP/1.1 401 Authorization Required
...
WWW-Authenticate: Basic realm="voetbal"
...
This indicated that the server did not know who was requesting the resource, so it could not decide
whether to grant permission. By asking for Basic authentication, the site would induce the web browser
to pop up a dialog box asking for a username and password. The information entered would then be sent
back in a header as part of a second request for exactly the same resource. The authentication token was
generated by doing base64 encoding on the colon-separated username and password:
>>> import base64
>>> print base64.b64encode("guido:vanOranje!")
Z3VpZG86dmFuT3JhbmplIQ==
This, of course, just protects any special characters in the username and password that might have
been confused as part of the headers themselves; it does not protect the username and password at all,
since they can very simply be decoded again:
>>> print base64.b64decode("Z3VpZG86dmFuT3JhbmplIQ==")
guido:vanOranje!
Anyway, once the encoded value was computed, it could be included in the second request like this:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
An incorrect password or unknown user would elicit additional 401 errors from the server, resulting
in the pop-up box appearing again and again. Finally, if the user got it right, she would either be shown
the resource or—if she in fact did not have permission—be shown a response code like the following:
403 Forbidden
Python supports this kind of authentication through a handler that, as your program uses it, can
accumulate a list of passwords. It is very careful to keep straight which passwords go with which web
sites, lest it send the wrong one and allow one web site operator to learn your password to another site! It
also checks the realm string specified by the server in its WWW-Authenticate header; this allows a single
web site to have several separate areas inside that each take their own set of usernames and passwords.
The handler can be created and populated with a single password like this:
auth_handler = .HTTPBasicAuthHandler()
auth_handler.add_password(realm='voetbal', uri='http://www.onsoranje.nl/',
» » » » » » user='guido', passwd='vanOranje!')
The resulting handler can be passed into build_opener(), just as we did with our debugging handler
early in this chapter.
157