CSC309: Web ProgrammingGreg Wilson 11Web Programming:Server-Side HTTPGreg [email protected] 20052The Active WebThe web is far more than just a fancy replacement for inter-library loanMost of its power comes from the fact that browsers can interact with programs that aren't web serversMore accurately, clients can ask web servers to run other programs on their behalfThis lecture looks at how to handle HTTP requestsPlease make sure you attend the security lecture!3The Common Gateway InterfaceHow to let everyday users write programs that handle HTTP requests?Require them to write socket-level code?Complicated and error-proneRequires lots of portsHave the web server handle the details!Recompiling it repeatedly would be a painSo define a protocol that lets it run external programs4…CGIThe Common Gateway Interface (CGI) specifies:How a web server passes data to a programHow that program passes data back to the serverRemember, the web runs on protocolsDoes not specify:A programming languageHow the server decides what program to runEach server defines its own configuration and permission rulesCSC309: Web ProgrammingGreg Wilson 25…CGIWhen a server runs a CGI, it sends data:Through environment variablesThings that are expected to be shortThrough standard inputThe "extra" data in the HTTP requestThe program sends data to the server through standard outputIn most cases, the server just forwards it to the clientSo the program must create all headers6CGI Environment Variables17290img/jpegname=mydog.jpg/cgi-bin/upload.pyGETHow much extra data is being sentCONTENT_LENGTHWhat kind of extra data is being sentCONTENT_TYPEQuery parameters from the URLQUERY_STRINGWhat's runningSCRIPT_NAMEor POSTREQUEST_METHOD7MIME TypesClients and servers need a way to specify data types to one anotherRemember, bytes are just bytesMultipart Internet Mail Extensions (MIME) standard defines:Families of types (image, audio, …)Particular members of families (JPEG, MP3, …)See RFC 2045Learn how to read RFCs!8…MIME TypesAdobe PDFapplication/pdfApplication-specific dataApple Quicktime video formatvideo/quicktimeVideoMP3 audio filesaudio/x-mp3AudioJPEG-format imagesimage/jpegImageWeb pagestext/htmlTextCSC309: Web ProgrammingGreg Wilson 39Hello, CGISimplest possible CGI pays no attention to query parameters or extra dataJust prints HTML to stdoutBut must also print Content-type headerAnd a blank line to separate headers from content#!/python/python.exeprint 'Content-type: text/html\n'print '<html><body><p>Hello, CGI!</p></body></html>'10Displaying the EnvironmentWhole point of CGI is active contentShow a list of environment variablesYou'll use this frequently when debugging…print 'Content-type: text/html\n'print '<html><body>'keys = os.environ.keys()keys.sort()for k in keys:print '<p>%s: %s</p>' % \(cgi.escape(k), cgi.escape(os.environ[k]))print '</body></html>'11…Environment OutputDOCUMENT_ROOT: /var/www/GATEWAY_INTERFACE: CGI/1.1HTTP_ACCEPT: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5HTTP_ACCEPT_CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.7HTTP_ACCEPT_ENCODING: gzip,deflateHTTP_ACCEPT_LANGUAGE: en-us,en;q=0.5HTTP_CONNECTION: keep-aliveHTTP_KEEP_ALIVE: 300HTTP_USER_AGENT: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2PATH: /usr/local/bin:/usr/bin:/bin…etc…12Creating FormsHTML forms allow users to…oh, you know how they workNot nearly as sophisticated as desktop GUIsBut programmers keep finding ways to do new thingsCreate a form using a <form> elementaction attribute specifies URL to send data tomethod attribute specifies type of request (i.e., GET or POST)CSC309: Web ProgrammingGreg Wilson 413…Creating FormsInside the form, can have:<select> elements to let users choose from a listList items specified using <option> elements<input> elements for other kinds of data<input type="text"> creates a text entry box<input type="checkbox"> creates an on/off box<input type="submit"> creates a submit button<input type="reset"> creates a reset buttonEtc.14A Simple Form<html><body><form action="http://www.bio.com/simple_form.py" method="POST"><p>Sequence: <input name="sequence" type="text" value="GATTACA"/>Search type:<select name="search_type"><option>Exact match</option><option selected="selected">Similarity match</option><option>Sub-match</option></select></p>…15…A Simple Form…<p>Programs:<input checked="checked" name="program" type="checkbox" value="FROG-11">FROG (version 1.1)</input><input name="program" type="checkbox" value="FROG-beta">FROG (2.0 beta)</input><input checked="checked" name="program" type="checkbox" value="Bayes-Hart">Bayes-Hart</input></p><p><input type="submit"/><input type="reset"/></p></form></body></html>16…A Simple FormCSC309: Web ProgrammingGreg Wilson 517ParametersEach input element has a name attributeBecomes the parameter name in the HTTP requestSubmitting the previous form with defaults sets os.environ['REQUEST_METHOD'] to "POST", etc.Stdin gets:sequence=GATTACA&search_type=Similarity+match&program=FROG-11&program=Bayes-Hart18Handling FormsWe could handle form data directlyBut the mechanics are the same each time, so use Python's cgi moduleDefines a FieldStorage classHas dictionary-like interfaceWhen one is created, Python fills it with dataKeys are parameter namesValues are either strings or listsExtra data available on stdin19Development TipsWhen writing CGIs, add this to the top:import cgitbcgitb.enable()Creates an HTML stack trace for errorsTesting whether a FieldStorage value is a string or a list is tediousUse fs.getfirst(name) if you expect oneOr fs.getlist(name) if you expect many20Maintaining StateAlmost always want to maintain state on the serverYour shopping cart, the message you're previewing, etc.CGIs can do this any way they want toIndustrial-strength solution is to use a relational databaseA three-tier architectureWe'll see this later in the courseCSC309: Web ProgrammingGreg Wilson 621…Maintaining StateSimple programs often just use filesCGI re-reads the file each time it handles an HTTP requestOverwrites it if state has changedExample: append messages to a web pageOld messages are saved in a file, one per
View Full Document
Unlocking...