Welcome to the Course

Hi, I’m Erik. I write and maintain this course, along with the rest of Python Land.

In HTTP with Python you built a reading list service with a login, a session cookie, and tokens that guard every write. It works, and its tests pass. That course asked whether the right request gets the right answer. This course asks what someone could make the service do that you, its owner, never intended. You find the weak places yourself and close them one at a time.

What you will harden

The method never changes. You run an attack and watch it work. You write a test that performs the attack and fails. You fix the code, and the test passes.

One rule

Attack only what you own.

Every attack in this course is aimed at handle() in your own project, either in memory or on 127.0.0.1, the loopback address your own machine uses to talk to itself. The helper written for this course, pl_sec.py, takes no host name, so it cannot be pointed anywhere else.

The same techniques work against real services. Using them against a service that is not yours, without its owner’s permission, is against the law in most places and against the point of this course.

What the site can and cannot reach

The sandboxes on Python Land have no route to the public internet. No lesson contacts a real website.

The site also has no browser. That matters from Chapter 8 on: which cookies travel with a request, and which page may read which response, are decisions a browser makes. So in Chapters 8 and 9 you write a small model of a browser yourself, one rule at a time, as plain Python functions. The model follows the published standards. It is still a model, and the lessons say where it is simpler than a real browser.

What is in the project

• reading_server.py is the server as HTTP with Python left it, in a reviewed copy, so everyone starts from the same code.

• http_adapter.py is the file you know plus one method, do_OPTIONS, which Chapter 9 needs. wire.py is unchanged.

• tests/test_attacks.py is where your attack tests go, and tests/helpers.py holds small functions those tests use.

• SECURITY.md is the list of weaknesses you find. It starts with four empty rows.

• pl_sec.py is a helper written for this course. It plays the other side: a client, a thief, an attacker.

Your client, reading_client.py, is not carried forward. Chapter 5 changes the tokens it would have to send, and this course is about the server.

What this course needs from you

You need HTTP with Python:

• handle(request, state), and the request and response dicts it works with;

• cookies and a session kept on the server;

• Basic credentials on login and bearer tokens on writes, and when a server answers 401 and when 403;

• a SHA-256 digest from hashlib, base64, and secrets.token_urlsafe;

• tests that call the handler directly and run with python -m pytest -q.

Python Fundamentals II is recommended, not required. http_adapter.py contains a class. You read it once, and no exercise asks you to write one.

Meet Monty

Monty is Python Land’s learning guide, beside every lesson. Ask for a second explanation, a hint that does not hand you the answer, or help reading an error.

When you are signed in, your free account includes 5 Monty helps a day, shared across all courses. A good first question here:

In plain words, what did my reading list server check before it let a request change a book?

The next lesson looks at that server through the eyes of someone who wants to misuse it.

Guided gives you up to 50 Monty helps a day. Questions, hints, error explanations, extra practice, and code reviews share the same daily allowance. The counter shows what is left and when it resets. Every lesson and ordinary exercise retry remains free.