CODEWITHSUNDEEP
pythonsecuritygoogle-app-engine
user1974513
user1974513

Reputation: 13

Header Check in Python (GAE)

I was wondering how I would go about checking HTTP headers to determine whether the request is valid or malformed. How can I do this in Python, more specifically, how can I do this in GAE?

Upvotes: 1

Views: 198

Answers (1)

Jimmy Kane
Jimmy Kane

Reputation: 16825

For some debugging and viewing the request with the headers I use the following DDTHandler class. 

import cgi
import wsgiref.handlers
import webapp2

class DDTHandler(webapp2.RequestHandler):

    def __start_display(self):
        self.response.out.write("<!--\n")

    def __end_display(self):
        self.response.out.write("-->\n")

    def __show_dictionary_items(self,dictionary,title):
        if (len(dictionary) > 0):
            request = self.request
            out = self.response.out
            out.write("\n" + title + ":\n")
            for key, value in dictionary.iteritems():
                out.write(key + " = " + value + "\n")

    def __show_request_members(self):
        request = self.request
        out = self.response.out
        out.write(request.url+"\n")
        out.write("Query = "+request.query_string+"\n")
        out.write("Remote = "+request.remote_addr+"\n")
        out.write("Path = "+request.path+"\n\n")
        out.write("Request payload:\n")
        if (len(request.arguments()) > 0): 
            for argument in request.arguments():
                value = cgi.escape(request.get(argument))
                out.write(argument+" = "+value+"\n")
        else:
            out.write("Empty\n")

        self.__show_dictionary_items(request.headers, "Headers")
        self.__show_dictionary_items(request.cookies, "Cookies")

    def view_request(self):
        self.__start_display()
        self.__show_request_members()
        self.__end_display()

    def view(self, aString):
        self.__start_display()
        self.response.out.write(aString+"\n")
        self.__end_display()

Example: 

class RootPage(DDTHandler):

    def get(self):      
        self.view_request()

Will output the request and contains the headers.

So check the code and get what you need. Thought as said, a malformed "invalid" request won't probably hit your app.

<!--
http://localhost:8081/
Query = 
Remote = 127.0.0.1
Path = /

Request payload:
Empty

Headers:
Referer = http://localhost:8081/_ah/login?continue=http%3A//localhost%3A8081/
Accept-Charset = ISO-8859-7,utf-8;q=0.7,*;q=0.3
Cookie = hl=en_US; dev_appserver_login="[email protected]:False:185804764220139124118"
User-Agent = Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.52 Safari/537.17
Host = localhost:8081
Accept = text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language = en-US,en;q=0.8,el;q=0.6

Cookies:
dev_appserver_login = [email protected]:False:185804764220139124118
hl = en_US
-->

Upvotes: 2

Related Questions