good afternoon everyone sorry good morning still
afternoon yet so uh
administrative stuff.
Okay, I will…
I'll answer questions about assignment three.
time for tutorial seven, tutorial five and six were due yesterday.
Assign.
Green is due.
Yes.
I will so.
My plan today is to talk about answer your questions about assignment three and answer
Talking about code and progress.
So for assignment, so for assignment three, question five so
I should have tutorial A, which is done by the
soon after class, I should be having that up. So if you have tutorial today.
It should be there by the beginning of class, but I'm guessing most of you are still
I'm working on tutorial seven
or assignment three. That's why I haven't been pushing it too hard.
But anyway.
Can you get some kind of solutions for past tutorials similar to the assignments?
The assignments incorporate everything in the tutorials. If there's something in the tutorial, a question that you don't know how to answer.
feel free to ask a TA or me but
At this point, once you do the assignment, you should understand the answers for the tutorials.
Yeah, if there's someone, I'm happy to talk about here.
But I specifically am not putting up solutions for those because again the
You should know whether you have the right answers to the tutorial.
If you don't know whether you have values of the tutorial, then
Probably approaching the material incorrectly.
So some questions now about
About assignment three so let's um
Okay.
Two.
Let's go to the assignment.
So the question is, is the question is
For assignment question five, do you want us to modify the server to receive the file itself
Instead of the JSON object.
uh…
If you need to change the server to upload the file instead of the JSON object.
then do so. But part of the question is is
deciding what you, you know, if you want the server to also valid, if you want to validate submissions
Also on the server, what do you need to change?
That is the question.
So for the sign question five, what does it mean validating on the server?
So mean by validating on the server, it means that the server checks
So remember.
the client
The server cannot trust
that any code has actually run in the client.
It can't trust that the browser's not done. Because remember, I can just make arbitrary get and posts.
I can just cook them up with whatever data I want and send them off.
it doesn't have to only come from the web page that was sent to the browser.
So in general, validation that happens on the
Let's true.
you know we can't
I mean, because who knows how this thing you know creates
So…
It can also be done on the server.
Okay, also question four.
We want us to upload invalid information using Doge, does it mean the normal file we submit was the JSON format we normally use?
So question four says, how could you use a command line web request tool? To upload data that is not a properly validated submission.
So the idea is that the client is set up
to only upload validated
solutions. It doesn't want to do that.
So how could you send invalid data
to the server.
Now, this is question four.
So you can assume that the code works as it does, like take it as the original version.
don't talk about it after any modifications so
send bad data to it. And what kind of data you want to send? I mean, you know.
It's not a properly validated submission.
But it thinks it's got the server thinks it's gotten the submissions. It wants to try
analyzing it, but it goes like, it goes like, whoa, that's not a submission so
Whatever you want to send.
Okay.
How am I supposed to know what the answer?
uh…
I don't quite understand how am I supposed to know the answer if I don't know?
That seems almost a philosophical question. You might want to clarify that one.
I'm not trying not to say names on stream, but I just…
you're supposed to figure it out. I'm happy to give hints or you can ask questions and stuff but
Yeah.
Question four on assignment three, I mean.
Actually, that's a bigger question. I may talk about that. Question four, are we doing this to a separate terminal while the server is running?
Yes, you should do this on a separate tool with the service running. You can also do it from your, you know, basically from whatever machine you can access
the server front. Remember, if it's running in the cloud
Um.
you have to be able to route it there. So you can do that from the command line there if you're doing things through
VS code.
you can route there. But if you're you can
do everything through VS Code. It will run the server.
And it will run it on
the browser, but you can then have a separate window where you do your own ssh
to the server.
From there, from the command line on the server, you can run the wget on local host.
So does that make sense?
I mean, you should be, I mean, you should be able to go and
log into the server and run the
run, you know, run code there.
And so you can log in a second time and run a command line tool that
accesses the server.
Okay. But in general, like just
If you don't know how to do something.
The point of programming classes, the point of much of computer science is
I mean, education in general is to learn how to solve problems
That's what you're here to do, to learn how to solve problems.
Right now, we're doing a very specific technical domain, but the general thing is you're trying to solve problems.
Solving problems solving problems
can sometimes be done by looking up
a solution that someone else has figured out.
And that's all well and good.
But you should be able to figure out answers.
kind of hope that up to this point, you've kind of learned how to solve problems so
Anyway, I think I've addressed the questions. Are there any other…
One's here.
So in that case, let me switch my browser over. Stop share here.
And let's share.
So again, we're here, tutorial on
This will be posted today.
The new tutorial is called Auth Demo, and I'm going to show you the code for it. It's not quite complete.
We're going to work on probably completing it some, but again we're here
Next Wednesday's win assignment three is due.
And then assignment four
will be based on the code of this tutorial. Tutorial nine will not be
will not really be directly on
The last assignment.
It'll be a separate little thing which will be fun to do
the codon of a tutorial eight, which is going to have some modifications
for assignment for assignment
that should be enough.
But in terms of what do we have going here, so I have this running.
So it's called authorization demo
So I have a username and password.
And then once you log in, what's supposed to happen
Students.
So there is um
you can upload a submission.
And we can do um
You can click this upload.
So it validates, we can upload. Now, I think this is going to break horribly
Yeah.
Yep, that broke.
I'll show you the errors in a second, but I've broken the upload and I'll show you why.
But so I've done that.
So I've got the student and then I have this admin
Perfect. Again.
fix that. So here I can do a list submissions
Oh, that actually worked.
Okay. The name's not there. That's fine.
and analyze submissions.
That all works.
And when you're at home, it goes back to this thing.
So there's a concept here.
that um
that you basically should be able to log in
to this and you can log in in two separate roles
as a student.
or as an admin. And the admin can list the submissions and analyze the submissions.
while the student
Honestly.
they can just upload submissions when they log in.
So separation of things
We have a notion of logging in. Remember last semester, last class we looked at
using cookies to logging in. So now I'm trying to integrate that into here.
But I also need to integrate some notion of
counts because it doesn't really make sense to have a separate student and admin and stuff without some notion.
of accounts. And so that's what we hear. So I have this thing here and I've got to have a create account.
Create account doesn't exist yet.
And right now, no accounts are actually defined.
So this is the nature of
app developments. You get to these points where you have this functionality, it's not quite working, it's all kind of broken and so
What I wanted to…
show you today.
is show you the development process and part of also showing
how this code all works.
And how this all fits together.
So that's my plan. That's my plan for today.
If you have
If there's other things you want to talk about.
please ask otherwise we're going to go down the rabbit hole and you can see what I've done to the code because there's a lot of stuff I've done.
And there's more that needs to be done.
So let's stop that share and let's go back to Emacs.
So here is off demo.
So off demo
has
In the static directory, what's served, there's an admin directory, which has got the list
And index, this add should be renamed to
what was it? So it was called create
So we will
So in the admin thing, we're going to rename this
to create that HTML.
that was the old ad
So we're going to turn that into a create, you know, to create an account screen
the index is there and then there's also the list
functionality.
So that's all there. We also have a login failed.
kind of, you know, plain page
This is all, you know.
the static content that's being served.
But the actual code has now been split up.
I split it up into multiple files because
It was just getting too annoying.
It was getting too annoying, getting too complicated, getting too confusing. And so we're going to have a separation of concerns.
So templates is probably the easiest one to understand.
So here, I just…
the templating files are renamed here. Instead of calling them template underscore
Whatever it is, I'm now in the template modules.
And they're just called header not found.
add record and these are
basically exactly the same code.
Except, and since app title is only referenced by this code, it's in here.
So that's all there.
This…
The only thing I've added, however, is this export keyword.
And I added this export to all of these functions because they're not being used in here.
So this module will be it's imported
If we go over now to
What I have at the top now
is I have these import lines.
I say import star as star as template from templates
stars db from here. So what this means is all the
all the functions, variables, whatever.
that have been exported
from these modules, from these JavaScript files.
will be assigned as members of this object.
That's the finder. So now we're going to have a DB object, which will have
properties, which will be all the exported things from off db and template will be an object of all these here.
So in templates, I've got header
not found and whatever. And here I have a look for not found
I just call template.not found.
Because that's how I, you know, because that's what i said
That's why I say at the top of the file here, I say import this
as template from there. So template's an object that's not defined.
And its properties are the things that were exported. So not found was a function
they're defined and so we just call it template not found. And the same thing. So all I had to do in my code is replace
These files…
These files have not been shared with you yet.
This code has not been shared with you yet. This code is just here because this code is
in development and you're going to see
of what it is. And you don't want to be messing with it just yet because it's
kind of broken. But by the end, but this is the code that's going to be in tutorial eight
And so you will have access to this very
shortly.
So question, is this like a tool utility function
is what like a tool utility function
I'm a little confused.
The export oh
Export is a built-in functionality in modern JavaScript.
It's used client-side and server-side.
Denno had its, sorry, Node had its own
module system
That's like the basis if you guys know about npm.
Denos doesn't use that. It can use it, but it doesn't natively use that. The thing it wants to use
is the same type of modules that are used client-side. And so that's what we're doing here. This is JavaScript functionality, import and export.
built into the language. And the syntax allows for lots of different ways of doing this. We've already seen the import functionality
when used for the database stuff. So if you look at now
I have here and we have this, we have this line here import
here, but corresponding to import
you need an export?
And so we're doing exports here. And so the exports can be basically be a property that's added to
any function, any declaration.
So you declare a variable, you can export it and stuff. The idea is that if it's not marked as export.
It is private. It is only visible
within the scope of this JavaScript file.
If you make a reference somewhere else they
They can't. It's private.
by saying exports, in effect, it's public
available to anyone who imports this code.
categor functions should not be used in its own file. No, they can be used. If you export it, that just means it's visible outside. It's basically like a public declaration.
in other languages. But it certainly can be used here.
So we have these templates. They're all exported
And then here, sorry, I would go back to
So we've imported it and then we can use it here as this property, this object. And so I literally went through and could just replace all the underscores.
with a dot. That was kind of why I
pick that particular syntax was because I was expecting
later to take this code and put it into a module.
Now, the AuthDB, this is now
has all the code
which accesses the database.
And…
So what that means is like the names of the tables and the database file
are all local
Here.
Oh, so.
Oh, export has nothing to do with client and server.
So this is um
So import.
Yes, import is like include.
Yeah, exactly. Learn an external JavaScript file.
if you look at imports.
includes in CNC++.
Include is actually a CCC++.
fee processor thing. There's no preprocessor here. There's just
Yeah.
Does export have its equivalent in other languages? Oh yes, it definitely does.
export
Really?
variables.
So really what's really what
So really, JavaScript
scope of like, what can you see is really limited to that file beyond
the things that are built into JavaScript. So there's a
there's a global namespace. There's things in there.
there's the things that are defined in your file
And then when you want to import another file, it doesn't just get willy nilly included into this one.
there's a there's a boundary between them and only the things that
the imported file export specifically is going to be included in the scope.
of this one so yeah so this is a very common kind of mechanism
You do this all the time when you look at Java with class files and things.
This is all pretty standard. This is just JavaScript's way of doing this.
And it has nothing
So yes, this is not changing
whether things are server side or client side.
It's just there.
But I waited to define this later.
really to show the reason you use this.
There's nothing magical about it. It's simply a method
for managing complexity.
In a lot of
if you look at a lot of programming environments nowadays, templates, you know, like the starter apps or things like that, what they tend to do
is they put everything into lots of separate files.
And they go like, oh, this is the way it's like
Almost always those separate files
are just there as a standard way of organizing things.
It's just what someone thought was a good way to organize your code.
So many times I look at it going like, that doesn't make sense for my code. There's too many little things or the things I really want to split up.
You should never take that as gospel. It is just
you know it's just the default which you can either use or not
I much more prefer
to limit the number of things my code is split up into and then divide it up
as functionality necessitates. Like when I want to manage complex and go like, okay.
my code, like I've got these sort of things, they should go over here. I've got these things that should go over there like
When I look at the templates.
you know you know the templates are all, you know, they're kind of a mess. They're sort of generally things like
We're looking separate files like why do I have to look at all this stuff?
here it's like they're going to do a specific thing in
given some arguments they will
do stuff with it so
Let's leave it that way. Now, and again, here for the database, there's all these
database specific things, you know, it's SQL code, there's these tables, there's a file. It's nice if all that messes
else is put aside and then the rest of my code can just
use it.
Thank you.
So speaking about the database.
I've changed around the database.
code a bit. In particular, you'll notice
that there's two tables.
there is an accounts table.
And there's a submission table, which has now been incremented to be tutorial eight.
Because of course, we're now in tutorial eight.
And, you know, so this is the um
And so why do I have two tables? Well, let's look at the schema.
you know what's the organization
of these different tables that are in this database.
So one is, this is our submission table.
basically the same.
Except for one thing.
I deleted something.
I deleted the name.
The only thing here is a student id
And the question text.
That's it. But similarly ID is still the primary key. Why do we do this? Because the same student could have multiple submissions.
we don't technically want to prevent that so
But then we have this
off table, which has got the accounts.
So this is where we're going to count and this is
And so here, the primary key
So my screen's a little dirty. You're not seeing it.
I was like, is there a doctor? No, that's just dirt on my screen.
So here we have some files here. We have the username
So that's a new thing because we have, you know, when you log in, you have a username, you have a password
So we have this username, we have a password.
We have access. So we're saying what kind of access
do they have?
And then we have a student ID field and then a name field.
So if I want to know if I want to know
what the name is associated with a given submission
I have to actually look in the off table
for, you know.
for that student id
And based on that student ID, I can get their name.
Ah, so good question.
When do these DB executes actually execute now since it is a separate file from the server code?
When you do an import.
Logically.
The code in this file runs.
at the moment of import.
So when I run this import, it's basically saying
Load that file.
Run it.
And some stuff's going to be defined as um
exported and stuff. Well, here, I'm just going to take the db object
And that DB should be here. And so import that and then that will be now in our namespace here. But this code is all
evaluated and runs.
So similarly, when we
When we do these imports logically at that line
When this line finishes executing, the code in that file has finished executing.
But note, what does that mean? In the case of like here
we've defined, you know, here, okay, so this code is going to run, the data is going to run. Here we're defining constants.
And then here we're defining functions. When you define a function, it doesn't run the function. It just defines it. You have to call it later.
But this code is immediate.
This code is going to run
when it's loaded. So yeah, this code is logically being run
Right there, right when db demo is.
And…
But otherwise, these functions are just being defined. They aren't being called.
They're going to be called elsewhere.
You look similar here, this code is function, function, function, function, declaration, declaration, declaration, declaration.
And then till we get to the bottom.
This code is run when we load it.
And so this is defining a variable
But here, this runs abort controller that creates an object.
server this calls dental service. This makes a server that runs that code. That's what sets it up.
And by setting this up, it actually means that a web server is now running. And when an incoming request comes.
it's going to call the handler function. And that's basically what causes all the rest of our code
to be invoked is Drew Handler.
And then, so the web server is running and then we immediately run this
set up a signal handler. So what happens when you know
you know we call you know this abort and then
And then we have this thing that when this server finishes.
This is, you know, returns a promise
And then…
we do this.
So any questions there for that?
That was a good question.
And actually, it was something I was wondering about. I was thinking that was the case.
When I was putting this code together, I was like
I think that's the case. I'm not sure what else would run but
And for a little bit, I was having some errors.
that will make me think
what's going on like what's going on
I expected the database to run, but it wasn't.
But it turns out I had an error in my database code
So it was failing. That was the bug I was having.
So then what functions do we have in our database module? The templates are easy. They're just HTML templates, same as before.
This has got a little more stuff. So I've defined a close function because remember
we call close otherwise, and DV isn't exported so
we have to give an option for closing this because only we have access to this database object.
That's here. So this is a funny thing about
This is true in C as well.
When you define these top level things.
they're…
They seem like globals.
But technically, these are not globals. They are global to
this file.
They're not accessible outside this file. This is a unit
of um
of confinement.
for the code.
using globals like here isn't actually
languages like C and stuff, actually, I think the rules about what's actually visible outside of it's a little more complicated but
Here it's pretty simple. The stuff that's defined here is
local to this file, no one else can see it unless it's explicitly exported.
And so what we've done here is we've exported all these functions. And so they're all going to be visible.
Close is easy, close the database.
But I have some other things here. So I have some stuff regarding accounts.
these accounts now have a get at an account
Where I just give a username, password, access to an ID name.
And that does an insert into the database.
I say get account for a username. I'm like, what's the account information for? So I get all the fields from this where username is this.
I have a you know a get.
get name and go like, so if there's a student id
What's the name associated with it?
So I select name from off table where student ID equals the student ID.
That should pull up that. I'll return the results of this.
Notice I'm not doing any error checking.
there's lots of room for error checking to make this code more robust.
Right now, I'm focused on
just getting things to basically work and we will
part of the tutorial will be
Let's watch this code break and how can we fix it up so it can't.
deal with, you know, so we can deal with problems.
But so this is all the stuff we're dealing with accounts.
And analyze the missions
exactly the same.
Because this is all coming from the admin side.
Although, so here's the interesting thing here. What we really need to do
These functions.
should potentially, these are now sensitive functions
Not everyone should be able to access all of them. Like for example.
adding an account, analyzing submissions, some of these things should only be doable by an admin user. Some of these things should only be doable by a student user.
where do you have the access control?
who decides what it's okay so
What I've done, which is a pretty standard thing in web applications.
is there's
basically no permission checks
here. This code just says, you asked me to query the database.
Querying the database, just give me the info I need or like give me the updates too and I'll do it.
So no, at most there might be a database error sign, but there's not going to be any sort of permission
issue here.
is like okay now i mean you can enforce permissions at the database level
But what's much more common in web applications is you enforce permissions.
at the web request level.
And the reason you do this is because that's kind of the closest
to incoming and like you basically before doing any functionality you basically check
am I allowed to do this functionality? And then I go for it.
So that means that I have to have an approach
to how I'm going to do security inside this.
How am I going to decide whether an operation is authorized or not?
Now I'm going to describe the security architecture which
has very clear flaws.
And one of the things I want to do in assignment
in your last assignment.
is fix this code so that basically so the functionality is essentially the same.
But it's doing things in a more secure manner. So you get an example of seeing what
is then you can…
But doing things in the more secure way
It's going to be more complicated. So here, I just want to have the logic
of the application be clear.
So no security stuff here except for like pulling
You know, adding an account, pulling the account. So we're manipulating that data, but we're not
doing anything with it.
Here is where we're, you know, here when there's actually requests for things, that's when we're going to
do that so that's do that.
The…
So in Handler, I've made one change so far
regarding the cookies and this is not
Yeah. So remember, what we want to do is
set a cookie
when things are authorized.
You know, a set of cookies saying
That's the security model here. We're going to set a cookie on the client when someone logs in.
And that cookie will then basically tell us
who the user is.
And then for other requests, we can check to see what the cookie is.
And based on the user that's returned there.
we can make decisions here.
So what does Handler do? Handler is going to work the same way as it has before.
But
when it gets to this
you know if there's an off user. So if the response object here that's returned by folks
has defined an auth user.
So this is we're setting the cookie
Roth user, we then add a header for set cookie
And we say auth user is
the auth user. So this is now going to be saved on the server. This is going to be sent back.
Now.
Is this secure?
Who not? Because anyone can forge a request and just put the username in as a cookie
as auth user in a cookie, and then our server is going to go like, okay, you're authorized to do these things.
We'll talk about how to do this in a more secure fashion, but this shows semantically what we want.
So, uh.
Okay, so I'll pause for a second. There was a question about grading.
What I will say is
I don't.
way later assignments more than
previous assignments per se
What I do do, however, is I do use different
grading scheme. So the lowest grade you will get in this class
is the grading scheme
that I've defined in the course outline.
I also do other grading schemes that have different weights. I can tell you right now, there is one grading scheme
where I just remove tutorial grades.
I removed tutorial grades. I increased the weighting of everything else.
Why do I do that? Because I don't believe the tutorials should lower your grade. The point of the tutorials
is in fact to raise your grade.
Because if you're diligent.
And you do all the tutorials
doing all the tools not mean understanding all the material. It just means basically showing up
showing the TAs that you're making an effort.
you can get, you know.
What's the weight of the, you know, what is it again? The weight of the two trails? I think it's like 20%.
Yep, 20%. Yeah. So it's 20%.
So.
You know, even if you didn't really understand the material of this course.
But you showed up and put in the effort, you get like 20%.
potentially added to your score, like, you know, of like 100% for that. That's what it is so
that should be raising your grade for the rest.
But I know some of you aren't so good with that.
So I have a grading scheme that discounts that and basically throws out the tutorials
and tries and weighs everything else and sees what you're great are. And I do other things.
Play other games with this. But in the you get the best grade for any
grading scheme. So if you show
Knowledge.
you'll, you know, you show that your grade will tend to reflect that
So.
So…
So if you have like all for your tutorials, then you're, you know, like some of the gradings, you know, so you're going to be able to get that boost to your grade. But if you didn't.
the tutorials won't bring down your grade.
So that's kind of simple. Let's go back to what we're talking about. So what's going on with the cookies?
Why am I saying this isn't secure?
This is all the stuff that remember you did in um
Remember in assignment three, you're asked at the command line.
to just send requests.
As part of saying the requests, I can set arbitrary headers.
Saying arbitrary headers, I can set arbitrary cookies.
The username is not a secret.
who the user is is not a secret.
The auth user is just auth user
the username. So if they just put in a username that happens to have admin access.
they will get admin access.
The trick for doing this securely
is it's fine to have an off user kind of value, but what it's being set to can't be something the attacker can guess.
It has to be something
unguessable.
Now, still you have the issue of cookie theft
the normal way we deal with cookie theft is you make it that this token is only valid for a certain
So not only do you make it a random value.
you make it a random value that's only valid
for a certain period of time. And the way you implement this is you basically maintain
a session database.
And the session database, you have the cookies. So all the cookie does is looks up your current session here. If the session is expired.
you have no access, but for as long as it's valid, that will then tell you what the user is and everything. And that's all opaque to the client, but
the server knows all this.
I'm not implementing a session
table now in this.
But what I'm doing, I haven't decided where I might do that first.
Next one, I probably might just use more of a secure layer or something but
Anyway, again, we're showing the basic functionality.
Does that make sense?
For the cookies?
So you just set the, you know, just set the cookie okay
So here's our handler. We have this thing now so we can set a cookie on the client.
we only have support for one because we're not implementing a general version of this because
Why do we need a general version of this? It's such a simple thing.
But now, how is the rest of our code changed?
File data file
exactly the same. What I could do
Here, and this is a design choice, is I could
check to see whether they're authorized.
to access a given file.
Good.
But here's the thing.
If I go in here, is there anything confidential
in these files.
No, there isn't. I mean, you could see the interface, but it won't actually get you any access.
So if none of these files are confidential.
So who cares?
If they want to try accessing it, they'll see it.
also makes it easier for development purposes.
Because we can test other things, but really we don't care. We're going
permissions when we're actually doing something sensitive, which really means
we're accessing databases.
So I'll get route
Same old.
Post, upload submission. That's right. But we've added a new one. If path is login, then we do the login
Note the sort of post. Go on.
Huh.
was a point of obscuring the entry fields into Trail 7 to hide user information.
uh…
Primarily where we obscured
things.
I'm not sure where we obscured things.
Yeah, I'm not sure. Yeah.
Oh, the height analysis.
Oh.
The height analysis was just to
clean up the interface.
That's all that was. That was just to hide parts of the dom
basically parts of the user interface so they aren't just cluttering the screen when
there's nothing there.
Is that what you were thinking of?
obscuring it like that. The hide is just
it's not a security thing at all it's just
a visual interface thing.
Okay, so no security mechanism there.
And in fact, that's still there.
If we go to static, we go to the
student, we go to the validator here
you'll go um
There's still hide analysis. But all this does is
hide part of the doll.
And we're saying, you know, we get this element and we're just saying that part's hidden.
you go into a web inspector
in your browser, you can see this portion that's hidden.
And you can unhide it. It just makes it clean.
So let's go back here. So we've got this
you know we've added this login thing
we can, so this is going to say we want to do the login operation here
what is this login operation?
So here is login. This is new, fresh code.
This code has not been tested yet.
I think it's mostly there.
So the logic of this is
I want them to type in a username and password.
I want them to check whether there's an account with that username. And if that account with that username
exists and they've entered the right password, I want to set off user
to that username so that later things will now
act like that user is logged in.
And can look it up if they want to figure out what permissions they have, they'll just look at that username
as needed at that time.
And where I then send the user after they log in depends upon what access they have.
I have only two kinds of access. There's student access and admin access, and that field just
contains either the word student or admin.
So what login does, so it gets the form
from the form, it gets a username, password. This is all stuff he's there. So I identify these, you know, auth user and response so
I get the account, so DB account, nay account username so this
for the username, it gets me the entire account
record, which includes the password.
So I have a C is the password that I got from the form is equal to the account password
And then this year. Okay, another security thing, I got an A.
This is not the way to do passwords.
This is very, very, very wrong.
This is the easiest way to implement it.
But this is wrong.
Anyone know why it's wrong?
I mean, technically this works. This is just
horribly insecure for many reasons.
So transmitting in the clear
In general.
web applications
Send passwords.
to the server.
If you're doing it over HTTP,
you have a problem because you have a problem
it is going in the clear. But the solution to that would not be at this level.
That would be to do the whole thing in TLS. So I wouldn't make this code insecure.
who would just say, you really should be using TLS to secure the entire connection.
Do you hash them on the client side?
No.
No, you don't typically hash them on the client side.
And the reason you, so what so now we're getting into password hashing.
So what it means is the database should not store the actual password. And the reason you don't, so this is worth emphasizing.
The basic solution to this
is password hashes.
And so, again, this is
complex security topic. But basically
you hash the password.
And the hash of the password just
one-way transformation of the password.
Password database stores the password hashes. The server hashes the password they got from the client
and compares it.
And then you have it. Now.
Why doesn't the client hash the password and send it to the server? I mean, I agree.
Then you have the nice thing of the password isn't sent
But remember, you can't trust client code
the client
So I'll talk about the hashing in a second.
you can't trust client code.
And in particular.
you can't be sure
that the client took the password that the user gave and hashed it. What they could have done is gotten the hash by some other means.
like what if they, you know, the server had been compromised and they got a copy of the hash
They could then send the hash
to the server and say, hey, I'm me.
And so it becomes a password equivalent.
And that's not what pastures should be.
Hashes should never be password equivalents.
So, uh.
So, but what is, hashing is not so much
Sure.
So let me explain. I'm going to explain this and then I can explain about being a password equivalent.
So why do we hash passwords?
So if the authentication database is compromised, attackers will not
have to work to figure out what the passwords are. We'll have to work to figure out what the passwords are.
This is when I say one way, this is what I mean.
You can, if you have X,
you can calculate hash of x. But if you have hash of x.
it is not easy guess X.
So, okay, so let's…
Okay. The explanation of the chat. That's great.
That's a good one.
it can require so it can require lots of guessing to do this this is
Bye.
Yeah, and that's why you used to, this is why you use tls
in real life to hide the password in plain text until it reaches the server. So the server has to have the password.
compute the hash itself of it, compare it to its hash database.
And then see if it's okay now
Are there…
doing password authentication without saying the password in the clear to the server.
So there are ways to send to like
to prove that you have a password without actually sending the password.
But I don't think those are used so much in practice.
unless they've expanded the web
standards to
to support them.
I'm a little curious now.
I mean, the fact is if you have TLS, it's fine and
You know, I'm not
I don't know where they would do it.
Oh.
Okay, so…
There's a peak.
like, oh.
Yeah, P-A-K-E is probably…
you know something like P-A-K-E and stuff like that so
So are these topics covered in uh so so
2108 doesn't quite cover this level. You really have to start talking about cryptography.
To see all this, which is, I think, 3108.
I think 21, I'm not sure whether cryptography is now 3108 or 4108, but the cryptography class.
RSA is actually
No, no, but 2108 is…
not a cryptography course. It's a general security course.
As I recall. These are all new curriculum changes.
And with the crypto coming later, but
Yeah, I forget how we divided up the topics.
So this is all relatively recent stuff.
Anyway, I should probably check, but in the security stream we
we definitely cover a lot of these topics. And it's very interesting uh but um
If you're going to do all these sort of things like how to do the passwords right now
It's a fun rabbit hole
it can be interesting to learn about
don't do it on your own. Learn it for your own intellectual curiosity and kind of
these things, but if you're building a real app of any kind.
you shouldn't be working at that level.
You want to use standard solutions which will
take care of these things.
Okay, yeah, yeah. It won't go into the math a lot into the concepts of encryption authentication, but yeah.
That's what 2108 does.
to all the concepts. Good.
Yeah, the actual cryptograph things like if you're learning about like
Well, you'll learn the concept of like password protocols and things and stuff like that.
that will be covered.
So let's go back to, so what was all this to say is
This is logically
functionally right, but from a security point
a disaster. Don't do this.
But we're doing this here just to show you what the logic of this is.
Yeah.
Yep.
Dave's good.
So.
We check the password. If the password is matching, then we can set the auth user to the username.
And then we can check to see what the account this is and if they're a student account, then we
return basically
this as our response.
Otherwise, we've returned this as ours, you know, the admin here.
Now, the only problem
And I need to think about what the
I haven't decided what the right way of doing this is, is that the username
the URL that you're getting
is not this URL.
It's like the original login url
And so what you often do is have a form submission that then does a redirect
to the actual page.
So I think I might change this to be a redirect.
to the right page and then just, you know, it basically returns the thing that sets the cookie
And then redirects to this page butt with them.
Sorry.
What am I doing here? So we've got
So this is going to show this. It says it's not, it's an authorized
And so the idea here is at this point.
If auth user
We say the account here
the accounting that this is matched. We've got a username. It matches the password. We go all this.
If it's not there, it's unauthorized.
Oh, right. So here we have a valid user, we have a valid password, do all this, but we have an invalid
account access. So access isn't student or admin and we don't know what to do that. That's an internal server error.
And that's why I'm returning internal server error because there never should be
an access that isn't student or admin.
Here, this branch we're doing unauthorized. This is saying that
We just go to the login failed because auth users unauthorized, so that won't be set.
or anything except that but
this is going to say it's failed. It will give a nice response saying, hey, you typed in the wrong, you know, we don't know who you are.
But this one's going to like, yeah, we're confusing the head because something broke.
But after this is done, after logging is done, we've redirected to these pages and we get our
the auth user cookie has now been set.
It's now subsequent responses. If we're logged in, we can expect that cookie to be there and we can check it.
So in particular, ad submission i've changed
to do this.
So now what add submission does is
it gets so the auth user
is I say request off user for the request
So requests off the user just gets the cookie
And, you know.
you know you know just get the cookie for auth user and forgetting the string and get cookie here. This is actually from um
the Clodo AI code that I used last time. I was trying to make my own and then I realized I was basically writing this.
So it's like…
this is perfectly fine so
gave credit. This is one of the funny things about using these
AI things
is I don't know what the license of this code is.
I mean, this is such a small bit of code that's doing something that's so
obvious
for cookie processing.
in terms of
you know, you basically are you're splitting on the semicolons between the things
then you're separating it based on
you know, basically you're splitting it on the equal sign. So your cookie name, cookie value, and then check to see if it's there. I mean, this is the most
simple, logical way of handling cookies.
So I don't really even think this code is necessarily copyrightable, but it came from Clod AI. It's like, I don't know where it came from.
I was really concerned about the licensing of my code that would be really
annoying to know what's
who do I give credit?
Is it just mine? Is the code that comes with CloudEye? Can I just use it freely?
This is one of the big IP issues around
Using AI things in any real sense that is, I don't know of any good solution yet. I think we're going to have to have some legislation
I feel like this sort of blows up the whole concept of copyright.
Oh, so why not make what a bad, so the question is, why don't I make…
There's a question here. Why don't I make this a bad request?
Also, there's a submission. Why don't I make this internal server, make this bad request?
I said this is an internal server error because
This is an invariant that my code should enforce. There's no one else that should be
Only my code is putting stuff into the database.
So since only my code's putting stuff into the database.
it should only be putting in student or admin.
If it puts something else there, my code's broken.
And in general, what internal server error means is the server's code is broken. It did something wrong.
At some point, maybe previously it stored some bad data and now you're seeing the bad data and now it's freaking out.
So.
That's why I did that.
Now we're going to add submission here so we
we get the account, the account is from the cookie
you know we're using this thing so we have the value. So we know this is now
the user that we had set in the login process we had set stayed the cookie
And so now we're going like
we have the account. This account has a student ID.
The submission has a student ID.
Are those the same?
If they're not the same.
We go like…
You know, you can't do this.
You know, you can't upload this because it's
you know, you're not logged in.
you can't submit assignments for another student. You can only submit assignments
for you.
And so we you know
So we have all this. It's checking the account.
does that equal? And if it does, then we do the ad submission and we say that and it's all.
And if it broke, then we say some reason we couldn't add it. And again, that doesn't make any sense.
Because we validated it
Well…
Here, we didn't validate it. Your code for assignment three will validate it.
But this doesn't validate it.
Yeah, but that's ideally what the server should do is it's not trusting the client to do this.
Oh, I may have to add that in there. So this is right now checking it.
Auth user get cookie
Now.
the analysis, this is all fine. But again, this should probably check
do the same thing. It should check to see whether it's an admin user.
But it should check what the auth user is.
an admin user, and then if so, we should only do analysis
We put this admin analyze.
list um
Let's change this to be admin slash list.
But I've changed my other code.
list submissions, doing the same things
Again, it should do a permission check.
Fear, mom type.
There.
So you'll see most of the functionalities there. There's certain little bits of functionality you need to finish.
I'm going to add some of that. I don't think I'm going to add all the permission checks and I'll have you do that. And then assignment three, there'll be more of that.
But I at least want to get the login stuff.
finish, which really means I need to have the ad account.
working.
We should just be on the route. But I am out of time.
I don't think I can add much code in two minutes so
I will stop here.
I will finish up.
the tutorial and put it online
Later today.
And I will um again i'm
given the number of people assignment three, I think all of you are still working on assignment three.
But it should be up by the later today.
If you're bored, message me if you're saying you really need this tutorial.
And maybe I'll work on it faster. Okay.
Have a good day, and I will see you all next week.
Are we?