How the Web Works Checkpoint

25 min · Intermediate

Fix the mistakes

The slips that cost marks in this module. Spot each one, then check the fix.

A real server reads a request, checks the method, the headers and the cookie, and answers with the right status code. This checkpoint builds that flow in small steps and then tests the whole module.

Read a request from the top

Split the raw text at the first blank line. The first line gives the method and path. The lines after it are headers. The rest is the body.

Python

raw = "GET /items HTTP/1.1\r\nHost: a.com\r\n\r\n"head, body = raw.split("\r\n\r\n", 1)request_line, *header_lines = head.split("\r\n")print(request_line.split()[0])

This prints GET. Every server framework does this work before your code runs.

Pick the status code on purpose

Ask three questions in order. Is the caller known? Is the caller allowed? Is the request itself valid? The answers lead to 401, 403 and 400 or 422. Success follows: 200, 201 or 204.

Python

1def check(token, role):2    if token is None:3        return 4014    if role != "admin":5        return 4036    return 200

Example 1 · A tiny request handler

Python

1from http import HTTPStatus2
3TOKENS = {"t-admin": "admin", "t-user": "customer"}4
5def handle(raw):6    head, _, body = raw.partition("\r\n\r\n")7    first, *lines = head.split("\r\n")8    method, path, _ = first.split()9    headers = {k.lower(): v for k, v in (l.split(": ", 1) for l in lines)}10    if method not in ("GET", "POST"):11        return HTTPStatus.METHOD_NOT_ALLOWED12    scheme, _, token = headers.get("authorization", "").partition(" ")13    role = TOKENS.get(token) if scheme == "Bearer" else None14    if role is None:15        return HTTPStatus.UNAUTHORIZED16    if path.startswith("/admin") and role != "admin":17        return HTTPStatus.FORBIDDEN18    return HTTPStatus.OK19
20def request(method, path, token=None):21    auth = f"Authorization: Bearer {token}\r\n" if token else ""22    return f"{method} {path} HTTP/1.1\r\nHost: a.com\r\n{auth}\r\n"23
24print(handle(request("GET", "/items", "t-user")))25print(handle(request("GET", "/items")))26print(handle(request("GET", "/admin/users", "t-user")))27print(handle(request("DELETE", "/items", "t-admin")))

Output

What this code does

The handler asks its questions in order: method, then identity, then permission.
Printing an HTTPStatus shows its number, because it is an integer type.

A missing login is 401. A known user without the right role is 403.

Know what HTTPS covers

HTTPS protects the request line, headers, cookies and body while they travel. It does not make your code correct, and it does not hide the server name completely. Keep certificate checks on.

Python

import ssl
ctx = ssl.create_default_context()print(ctx.check_hostname, ctx.verify_mode == ssl.CERT_REQUIRED)

Example 2 · Cookies and counting visits

Python

1from fastapi import Cookie, FastAPI, Response2from fastapi.testclient import TestClient3
4app = FastAPI()5
6@app.get("/hello")7def hello(response: Response, visits: int = Cookie(default=0)):8    response.set_cookie("visits", str(visits + 1), httponly=True)9    return {"visits": visits + 1}10
11client = TestClient(app)12for _ in range(3):13    print(client.get("/hello").json())14client.cookies.clear()15print(client.get("/hello").json())

Output

{'visits': 1}
{'visits': 2}
{'visits': 3}
{'visits': 1}

What this code does

The test client sends the cookie back, like a browser.
After the cookies are cleared, the server sees a new visitor.

Both checks are on by default. Leave them on.

Finish up

Mark complete & continue

Next: Resources and URLs

1from http import HTTPStatus2 3TOKENS = {"t-admin": "admin", "t-user": "customer"}4 5def handle(raw):6 head, _, body = raw.partition("\r\n\r\n")7 first, *lines = head.split("\r\n")8 method, path, _ = first.split()9 headers = {k.lower(): v for k, v in (l.split(": ", 1) for l in lines)}10 if method not in ("GET", "POST"):11 return HTTPStatus.METHOD_NOT_ALLOWED12 scheme, _, token = headers.get("authorization", "").partition(" ")13 role = TOKENS.get(token) if scheme == "Bearer" else None14 if role is None:15 return HTTPStatus.UNAUTHORIZED16 if path.startswith("/admin") and role != "admin":17 return HTTPStatus.FORBIDDEN18 return HTTPStatus.OK19 20def request(method, path, token=None):21 auth = f"Authorization: Bearer {token}\r\n" if token else ""22 return f"{method} {path} HTTP/1.1\r\nHost: a.com\r\n{auth}\r\n"23 24print(handle(request("GET", "/items", "t-user")))25print(handle(request("GET", "/items")))26print(handle(request("GET", "/admin/users", "t-user")))27print(handle(request("DELETE", "/items", "t-admin")))

1from fastapi import Cookie, FastAPI, Response2from fastapi.testclient import TestClient3 4app = FastAPI()5 6@app.get("/hello")7def hello(response: Response, visits: int = Cookie(default=0)):8 response.set_cookie("visits", str(visits + 1), httponly=True)9 return {"visits": visits + 1}10 11client = TestClient(app)12for _ in range(3):13 print(client.get("/hello").json())14client.cookies.clear()15print(client.get("/hello").json())