Foundations of Python Network Programming 978-1-4302-3004-5

CHAPTER 9 ■ HTTP
So the techniques to attack sites have evolved and mutated. Today, would-be attackers find ways
around this policy by using a constellation of attacks called cross-site scripting (known by the acronym
XSS to prevent confusion with Cascading Style Sheets). These techniques include things like finding the
fields on a web page where the site will include snippets of user-provided data without properly
escaping them, and then figuring out how to craft a snippet of data that will perform some
compromising action on behalf of the user or send private information to a third party. Next, the wouldbe
attackers release a link or code containing that snippet onto a popular web site, bulletin board, or in
spam e-mails, hoping that thousands of people will click and inadvertently assist in their attack against
the site.
There are a collection of techniques that are important for avoiding cross-site scripting; you can find
them in any good reference on web development. The most important ones include the following:
• When processing a form that is supposed to submit a POST request, always
carefully disregard any GET parameters.
• Never support URLs that produce some side effect or perform some action simply
through being the subject of a GET.
• In every form, include not only the obvious information—such as a dollar amount
and destination account number for bank transfers—but also a hidden field with a
secret value that must match for the submission to be valid. That way, random
POST requests that attackers generate with the dollar amount and destination
account number will not work because they will lack the secret that would make
the submission valid.
While the possibilities for XSS are not, strictly speaking, problems or issues with the HTTP protocol
itself, it helps to have a solid understanding of them when you are trying to write any program that
operates safely on the World Wide Web.
WebOb
We have seen that HTTP requests and responses are each represented by ad-hoc objects in urllib2.
Many Python programmers find its interface unwieldy, as well as incomplete! But, in their defense, the
objects seem to have been created as minimal constructs, containing only what urllib2 needed to
function.
But a library called WebOb is also available for Python (and listed on the Python Package Index) that
contains HTTP request and response classes that were designed from the other direction: that is, they
were intended all along as general-purpose representations of HTTP in all of its low-level details. You
can learn more about them at the WebOb project web page: http://pythonpaste.org/webob/
This library’s objects are specifically designed to interface well with WSGI, which makes them useful
when writing HTTP servers, as we will see in Chapter 11.
Summary
The HTTP protocol sounds simple enough: each request names a document (which can be an image or
program or whatever), and responses are supposed to supply its content. But the reality, of course, is
rather more complicated, as its main features to support the modern Web have driven its specification,
RFC 2616, to nearly 60,000 words. In this chapter, we tried to capture its essence in around 10,000 words
and obviously had to leave things out. Along the way, we discussed (and showed sample Python code)
for the following concepts:
161