SlideShare a Scribd company logo
Web Security Programming I Building Security in from the Start Except where otherwise noted all portions of this work are Copyright (c) 2007 Google  and are licensed under the Creative Commons Attribution 3.0 License  http://creativecommons.org/licenses/by/3.0/
A Simple Web Server ,[object Object],[object Object],[object Object]
Some Preliminaries… ,[object Object],[object Object],[object Object]
Some Preliminaries… ,[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: main() ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer Object ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: processRequest 1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: processRequest 2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: serveFile 1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: serveFile 2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SimpleWebServer: serveFile 3 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
[object Object]
What Can Go Wrong? ,[object Object],[object Object],[object Object]
DoS on SimpleWebServer? ,[object Object]
DoS on SimpleWebServer? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
DoS on SimpleWebServer? ,[object Object],[object Object]
How Do We Fix This? ,[object Object],[object Object]
How would you fix this code? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
A possible solution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Importance of “Careful” Exception Handling ,[object Object],[object Object]
Careful Exception Handling ,[object Object],[object Object],[object Object],[object Object],[object Object]
Careful Exception Handling ,[object Object],[object Object],[object Object],[object Object]
Fail-Safe ,[object Object],[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object]
Sources ,[object Object],[object Object],[object Object]

More Related Content

What's hot

A.java
A.javaA.java
Networking & Socket Programming In Java
Networking & Socket Programming In JavaNetworking & Socket Programming In Java
Networking & Socket Programming In Java
Ankur Agrawal
 
Socket.io (part 1)
Socket.io (part 1)Socket.io (part 1)
Socket.io (part 1)
Andrea Tarquini
 
Pemrograman Jaringan
Pemrograman JaringanPemrograman Jaringan
Pemrograman Jaringan
belajarkomputer
 
8 Minutes On Rack
8 Minutes On Rack8 Minutes On Rack
8 Minutes On Rack
danwrong
 
Socket.io
Socket.ioSocket.io
Socket.io
Timothy Fitz
 
Mule esb first http connector
Mule esb first http connectorMule esb first http connector
Mule esb first http connector
Germano Barba
 
JSON Rules Language
JSON Rules LanguageJSON Rules Language
JSON Rules Language
giurca
 
From Web Developer to Hardware Developer
From Web Developer to Hardware DeveloperFrom Web Developer to Hardware Developer
From Web Developer to Hardware Developer
alexshenoy
 
Socket Programming
Socket ProgrammingSocket Programming
Socket Programming
Sivadon Chaisiri
 
Sitecore - Deep drive into the Sitecore Client pipelines
Sitecore - Deep drive into the Sitecore Client pipelinesSitecore - Deep drive into the Sitecore Client pipelines
Sitecore - Deep drive into the Sitecore Client pipelines
Benjamin Vangansewinkel
 
Nodejs 프로그래밍 ch.3
Nodejs 프로그래밍 ch.3Nodejs 프로그래밍 ch.3
Nodejs 프로그래밍 ch.3
HyeonSeok Choi
 
Rack Middleware
Rack MiddlewareRack Middleware
Rack Middleware
LittleBIGRuby
 
Network programming in java - PPT
Network programming in java - PPTNetwork programming in java - PPT
Network programming in java - PPT
kamal kotecha
 
Extending Retrofit for fun and profit
Extending Retrofit for fun and profitExtending Retrofit for fun and profit
Extending Retrofit for fun and profit
Matthew Clarke
 
Sockets
SocketsSockets
Sockets
naniix21_3
 
Going real time with Socket.io
Going real time with Socket.ioGoing real time with Socket.io
Going real time with Socket.io
Arnout Kazemier
 
Acs sim errorlog
Acs sim errorlogAcs sim errorlog
Acs sim errorlog
Pankaj Debnath
 
Real Time Communication using Node.js and Socket.io
Real Time Communication using Node.js and Socket.ioReal Time Communication using Node.js and Socket.io
Real Time Communication using Node.js and Socket.io
Mindfire Solutions
 
Socket.IO
Socket.IOSocket.IO
Socket.IO
Arnout Kazemier
 

What's hot (20)

A.java
A.javaA.java
A.java
 
Networking & Socket Programming In Java
Networking & Socket Programming In JavaNetworking & Socket Programming In Java
Networking & Socket Programming In Java
 
Socket.io (part 1)
Socket.io (part 1)Socket.io (part 1)
Socket.io (part 1)
 
Pemrograman Jaringan
Pemrograman JaringanPemrograman Jaringan
Pemrograman Jaringan
 
8 Minutes On Rack
8 Minutes On Rack8 Minutes On Rack
8 Minutes On Rack
 
Socket.io
Socket.ioSocket.io
Socket.io
 
Mule esb first http connector
Mule esb first http connectorMule esb first http connector
Mule esb first http connector
 
JSON Rules Language
JSON Rules LanguageJSON Rules Language
JSON Rules Language
 
From Web Developer to Hardware Developer
From Web Developer to Hardware DeveloperFrom Web Developer to Hardware Developer
From Web Developer to Hardware Developer
 
Socket Programming
Socket ProgrammingSocket Programming
Socket Programming
 
Sitecore - Deep drive into the Sitecore Client pipelines
Sitecore - Deep drive into the Sitecore Client pipelinesSitecore - Deep drive into the Sitecore Client pipelines
Sitecore - Deep drive into the Sitecore Client pipelines
 
Nodejs 프로그래밍 ch.3
Nodejs 프로그래밍 ch.3Nodejs 프로그래밍 ch.3
Nodejs 프로그래밍 ch.3
 
Rack Middleware
Rack MiddlewareRack Middleware
Rack Middleware
 
Network programming in java - PPT
Network programming in java - PPTNetwork programming in java - PPT
Network programming in java - PPT
 
Extending Retrofit for fun and profit
Extending Retrofit for fun and profitExtending Retrofit for fun and profit
Extending Retrofit for fun and profit
 
Sockets
SocketsSockets
Sockets
 
Going real time with Socket.io
Going real time with Socket.ioGoing real time with Socket.io
Going real time with Socket.io
 
Acs sim errorlog
Acs sim errorlogAcs sim errorlog
Acs sim errorlog
 
Real Time Communication using Node.js and Socket.io
Real Time Communication using Node.js and Socket.ioReal Time Communication using Node.js and Socket.io
Real Time Communication using Node.js and Socket.io
 
Socket.IO
Socket.IOSocket.IO
Socket.IO
 

Viewers also liked

Yy (68)
Yy (68)Yy (68)
Yy (68)google
 
dgdgdgdgd
dgdgdgdgddgdgdgdgd
dgdgdgdgd
Thiago Sturmer
 
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...Michael Kirst-Neshva
 
30美丽的名片
30美丽的名片30美丽的名片
30美丽的名片zsk91186
 
осъдителна присъда кюстендилски окръжен съд
осъдителна присъда  кюстендилски окръжен съдосъдителна присъда  кюстендилски окръжен съд
осъдителна присъда кюстендилски окръжен съдKristiyan Petroff
 
Attom
AttomAttom
Daaaaaa
DaaaaaaDaaaaaa
Unit 4 Saving and Investing PPT
Unit 4 Saving and Investing PPTUnit 4 Saving and Investing PPT
Unit 4 Saving and Investing PPT
Jenny Hubbard
 
sistemas
sistemas sistemas
sistemas
carloschavezsdi
 
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙ 실시간토토 실 시간배팅
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙  실시간토토  실  시간배팅스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙  실시간토토  실  시간배팅
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙ 실시간토토 실 시간배팅
fdghjhj
 
Crear Unha Conta Gmail
Crear Unha Conta GmailCrear Unha Conta Gmail
Crear Unha Conta Gmailvicente
 
Lesson #3
Lesson #3Lesson #3
Lesson #3
smith1853
 
Co Ownership And Shared Equity Arrangements
Co Ownership And Shared Equity ArrangementsCo Ownership And Shared Equity Arrangements
Co Ownership And Shared Equity Arrangements
ZCD Properties Inc
 
Case Study Analysis Lucent Technologies
Case Study Analysis Lucent TechnologiesCase Study Analysis Lucent Technologies
Case Study Analysis Lucent Technologies
Djadja Sardjana
 
Khoa van-tay-kaba e10-fingerprint doorlock
Khoa van-tay-kaba e10-fingerprint doorlockKhoa van-tay-kaba e10-fingerprint doorlock
Khoa van-tay-kaba e10-fingerprint doorlock
Protocol Corporation
 
The Beauty Of The Sea
The Beauty Of The SeaThe Beauty Of The Sea
The Beauty Of The Sea
Popescu Florin
 
Misawa Post Office Holiday Schedule
Misawa Post Office Holiday ScheduleMisawa Post Office Holiday Schedule
Misawa Post Office Holiday Schedule
NAF Misawa
 
WASH United India | Fellowships | Round 2
WASH United India | Fellowships | Round 2WASH United India | Fellowships | Round 2
WASH United India | Fellowships | Round 2
WASH United
 
Module english
Module englishModule english
Module english
Amer Syarifuddin
 
Migrating from PHP 4 to PHP 5
Migrating from PHP 4 to PHP 5Migrating from PHP 4 to PHP 5
Migrating from PHP 4 to PHP 5
John Coggeshall
 

Viewers also liked (20)

Yy (68)
Yy (68)Yy (68)
Yy (68)
 
dgdgdgdgd
dgdgdgdgddgdgdgdgd
dgdgdgdgd
 
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...
Hybrid cloud iaa-s_office-365-azure_sharepoint-konferenz-wien-2013_ankbs_mich...
 
30美丽的名片
30美丽的名片30美丽的名片
30美丽的名片
 
осъдителна присъда кюстендилски окръжен съд
осъдителна присъда  кюстендилски окръжен съдосъдителна присъда  кюстендилски окръжен съд
осъдителна присъда кюстендилски окръжен съд
 
Attom
AttomAttom
Attom
 
Daaaaaa
DaaaaaaDaaaaaa
Daaaaaa
 
Unit 4 Saving and Investing PPT
Unit 4 Saving and Investing PPTUnit 4 Saving and Investing PPT
Unit 4 Saving and Investing PPT
 
sistemas
sistemas sistemas
sistemas
 
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙ 실시간토토 실 시간배팅
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙  실시간토토  실  시간배팅스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙  실시간토토  실  시간배팅
스타토토⊙o⊙Wifi89,cOm(카톡: XaZa⊙o⊙ 실시간토토 실 시간배팅
 
Crear Unha Conta Gmail
Crear Unha Conta GmailCrear Unha Conta Gmail
Crear Unha Conta Gmail
 
Lesson #3
Lesson #3Lesson #3
Lesson #3
 
Co Ownership And Shared Equity Arrangements
Co Ownership And Shared Equity ArrangementsCo Ownership And Shared Equity Arrangements
Co Ownership And Shared Equity Arrangements
 
Case Study Analysis Lucent Technologies
Case Study Analysis Lucent TechnologiesCase Study Analysis Lucent Technologies
Case Study Analysis Lucent Technologies
 
Khoa van-tay-kaba e10-fingerprint doorlock
Khoa van-tay-kaba e10-fingerprint doorlockKhoa van-tay-kaba e10-fingerprint doorlock
Khoa van-tay-kaba e10-fingerprint doorlock
 
The Beauty Of The Sea
The Beauty Of The SeaThe Beauty Of The Sea
The Beauty Of The Sea
 
Misawa Post Office Holiday Schedule
Misawa Post Office Holiday ScheduleMisawa Post Office Holiday Schedule
Misawa Post Office Holiday Schedule
 
WASH United India | Fellowships | Round 2
WASH United India | Fellowships | Round 2WASH United India | Fellowships | Round 2
WASH United India | Fellowships | Round 2
 
Module english
Module englishModule english
Module english
 
Migrating from PHP 4 to PHP 5
Migrating from PHP 4 to PHP 5Migrating from PHP 4 to PHP 5
Migrating from PHP 4 to PHP 5
 

Similar to Web

[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
hanneloremccaffery
 
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docxProject Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
kacie8xcheco
 
Web Server.pdf
Web Server.pdfWeb Server.pdf
Web Server.pdf
Bareen Shaikh
 
1)Building a MultiThreaded Web ServerIn this lab we will devel
1)Building a MultiThreaded Web ServerIn this lab we will devel1)Building a MultiThreaded Web ServerIn this lab we will devel
1)Building a MultiThreaded Web ServerIn this lab we will devel
AgripinaBeaulieuyw
 
Socket Programming it-slideshares.blogspot.com
Socket  Programming it-slideshares.blogspot.comSocket  Programming it-slideshares.blogspot.com
Socket Programming it-slideshares.blogspot.com
phanleson
 
Mail Server Project Report
Mail Server Project ReportMail Server Project Report
Mail Server Project Report
Kavita Sharma
 
Servlets
ServletsServlets
Servlets
Manav Prasad
 
Servlets
ServletsServlets
Servlets
ramesh kumar
 
T2
T2T2
T2
Mo Ch
 
Sockets
SocketsSockets
Sockets
sivindia
 
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmenMCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
VannaSchrader3
 
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docxMCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
alfredacavx97
 
Server Side? Swift
Server Side? SwiftServer Side? Swift
Server Side? Swift
Takaaki Tanaka
 
Node.js System: The Approach
Node.js System: The ApproachNode.js System: The Approach
Node.js System: The Approach
Haci Murat Yaman
 
Socket Programming - nitish nagar
Socket Programming - nitish nagarSocket Programming - nitish nagar
Socket Programming - nitish nagar
Nitish Nagar
 
Network Programming Clients
Network Programming ClientsNetwork Programming Clients
Network Programming Clients
Adil Jafri
 
Servlets
ServletsServlets
Unit 8 Java
Unit 8 JavaUnit 8 Java
Unit 8 Java
arnold 7490
 
Rpi python web
Rpi python webRpi python web
Rpi python web
sewoo lee
 
03 sockets
03 sockets03 sockets
03 sockets
Pavan Illa
 

Similar to Web (20)

[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
[Type text]ECET465Project 2Project Assignment 2 Building a Mul.docx
 
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docxProject Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
Project Assignment 2 Building a Multi-Threaded Web ServerThis pro.docx
 
Web Server.pdf
Web Server.pdfWeb Server.pdf
Web Server.pdf
 
1)Building a MultiThreaded Web ServerIn this lab we will devel
1)Building a MultiThreaded Web ServerIn this lab we will devel1)Building a MultiThreaded Web ServerIn this lab we will devel
1)Building a MultiThreaded Web ServerIn this lab we will devel
 
Socket Programming it-slideshares.blogspot.com
Socket  Programming it-slideshares.blogspot.comSocket  Programming it-slideshares.blogspot.com
Socket Programming it-slideshares.blogspot.com
 
Mail Server Project Report
Mail Server Project ReportMail Server Project Report
Mail Server Project Report
 
Servlets
ServletsServlets
Servlets
 
Servlets
ServletsServlets
Servlets
 
T2
T2T2
T2
 
Sockets
SocketsSockets
Sockets
 
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmenMCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen
 
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docxMCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
MCIS 6163 Assignment 1MCIS 6163 Assignment 1.pdfAssignmen.docx
 
Server Side? Swift
Server Side? SwiftServer Side? Swift
Server Side? Swift
 
Node.js System: The Approach
Node.js System: The ApproachNode.js System: The Approach
Node.js System: The Approach
 
Socket Programming - nitish nagar
Socket Programming - nitish nagarSocket Programming - nitish nagar
Socket Programming - nitish nagar
 
Network Programming Clients
Network Programming ClientsNetwork Programming Clients
Network Programming Clients
 
Servlets
ServletsServlets
Servlets
 
Unit 8 Java
Unit 8 JavaUnit 8 Java
Unit 8 Java
 
Rpi python web
Rpi python webRpi python web
Rpi python web
 
03 sockets
03 sockets03 sockets
03 sockets
 

Recently uploaded

“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
Edge AI and Vision Alliance
 
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Pitangent Analytics & Technology Solutions Pvt. Ltd
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
Javier Junquera
 
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
Edge AI and Vision Alliance
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Alpen-Adria-Universität
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Neo4j
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
c5vrf27qcz
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Neo4j
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
AstuteBusiness
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Tosin Akinosho
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
JavaLand 2024: Application Development Green Masterplan
JavaLand 2024: Application Development Green MasterplanJavaLand 2024: Application Development Green Masterplan
JavaLand 2024: Application Development Green Masterplan
Miro Wengner
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
Antonios Katsarakis
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
Zilliz
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
Zilliz
 

Recently uploaded (20)

“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
 
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
 
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
 
Artificial Intelligence and Electronic Warfare
Artificial Intelligence and Electronic WarfareArtificial Intelligence and Electronic Warfare
Artificial Intelligence and Electronic Warfare
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
JavaLand 2024: Application Development Green Masterplan
JavaLand 2024: Application Development Green MasterplanJavaLand 2024: Application Development Green Masterplan
JavaLand 2024: Application Development Green Masterplan
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
 

Web

  • 1. Web Security Programming I Building Security in from the Start Except where otherwise noted all portions of this work are Copyright (c) 2007 Google and are licensed under the Creative Commons Attribution 3.0 License http://creativecommons.org/licenses/by/3.0/
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.

Editor's Notes

  1. Now we walk through the code… Main() creates a SimpleWebServer object and calls its run() method. The run() method is just an infinite loop that waits for a connection from a client, and then attempts to process the request.
  2. Here is the SimpleWebServer object. First we initialize a variable that holds the port number the web server should listen to for connections from clients. Then we initialize a ServerSocket. Socket: The method of directing data to the appropriate application in a TCP/IP network. The combination of the IP address of the station and a port number make up a socket. Think of this like an electrical socket. A web server and a web client both have a “virtual” power strip with many sockets on it. A web client can talk to a server by selecting one of its sockets, and then selecting a server socket and plugging a virtual wire into each end. The run() method has an infinite loop waiting for a connection from a client. The call to ServerSocket accept() returns a socket object that corresponds to a unique socket on the server. This allows the server to communicate with the client. Once the communication is established, the client’s request is processed.
  3. processRequest() takes the client socket as input. It uses this socket to create BufferedReader and OutputStreamWriter objects. Once these communication objects are created, the method attempts to read a line of input from the client using the BufferedReader. We expect this line of input to be an HTTP GET request (as discussed earlier).
  4. The StringTokenizer object is used to break up the request into its constituent parts: GET, the pathname to the file the client would like to download. If the command is a “GET”, we call the serveFile() method, else we issue an error. Then we close the connection to the client.
  5. The first “if” removes the initial slash at the beginning of the pathname, and the second “if” sets the file to be downloaded = index.html, if another file was not specified.
  6. Now the method attempts to open the file and read it into the web server’s memory. If the FileReader object is unable to open the file and read a byte from it, it issues an error message.
  7. If the file was successfully opened, send the HTTP/1.0 200 OK message and then the method enters a while loop that reads bytes from the file and appends them to a StringBuffer, until the end of the file is reached. Then this StringBuffer is sent to the client.
  8. Trace the code, assuming a CR sent from the client. We read the line of input from the client. When we tokenize, the line: command = st.nextToken(); results in an exception. Control is returned to run() which does not handle the exception; then control is returned to main() which does not handle the exception either. Java terminates the application.
  9. Close the connection to the client, rather than crash the server…
  10. We also need to make sure the function fails in a secure manner.
  11. This is also a good example of a fail-safe approach: even if one or more components of a system fail, there is still some level of security.