spaceone / httoop

HTTOOP - a fully object oriented HTTP protocol library written in python

Welcome to my github profile.

I am an Open Source Software Enginner working for Univention.

My special interests are HTTP, REST, Security technology, Python and Clean-Code - and I like to combine all of them.

Univention GmbH

At Univention I am working at the Debian based Linux Distribution Univention Corporate Server.

My focus topics there are: IAM (Identity and Access Management):

• OpenLDAP
• REST-Services for LDAP-objects
• Active Directory & Samba 4 to OpenLDAP connector
• A little bit Kerberos (Heimdal) and Samba 4

Web Interfaces & Design:

• Javascript (dojo toolkit) web frontend
• HTTP backends
• responsive Web-Design

Python:

• Python 2.7 to 3 migration

Security:

• Finding and fixing internal security issues

Dockerization:

• of our currently Debian packages components

private stuff

security

In my spare time I used to do Hacking Challenges and penetation testing (e.g. at WeChall).

httoop

I am the inventor of httoop, an object oriented HTTP library (for implementing HTTP servers, clients, caches and proxies) focusing on strict compliance, security, object orientation, simplicity in use, using strictly the vocabulary of HTTP instead of inventing own things and not doing extra things and workarounds. It's the best HTTP library I've seen in the Python world so far. As I am miserable in marketing, there are only a few users yet.

circuits

I am maintainer of circuits. Circuits is a Lightweight Event driven and Asynchronous Application Framework for the Python Programming Language with a strong Component Architecture. A project which exists long before asyncio - but nowadays isn't as modern as these frameworks - maybe we can catch up somewhen.

circuits.http

While circuits has a circuits.web component, I created a different Implementation called circuits.http using my httoop project as basis. This focused on more explicit request routing and simplifies implementing all HTTP functionalities and REST principles.

configuration files

I am a heavy user of Linux, Python, vim, sway/i3-wm. My configration files are available as Debian package at dotfiles.

statistics

httoop's Issues

Add fuzzy tests

Have a look at: https://hypothesis.readthedocs.org/en/latest/quickstart.html

StateMachine should parse headers immediately

Currently the state machine waits until receiving \r\n\r\n which marks the end of headers. This is not necessary. It could parse each header until it sees \r\n + any byte except a space (\r\n ) which would indicate a continuation line.

Add Referrer-Policy, Feature-Policy, Permissions-Policy security header

There are some new security headers since some years:
Referrer-Policy, Feature-Policy, Permissions-Policy

Let's add their syntax.

Add Python3.5 support

"bytes" doesn't support %s syntax or .format() method. It is readded in python3.5.
Maybe py2to3 helps.

lowercase/pep8-name all status classes

Currently all HTTP Status Exception classes are in the naming scheme of a constant, e.g. BAD_REQUEST.
This should be changed into BadRequest before releasing the 1.0 version on PyPI.

Update cookie header to support same-site parameter

Update cookie header to support same-site parameter

Reject messages with multiple single-value headers

Some HTTP headers might occurr only once in a HTTP message (e.g. Content-Length, Location, Host, Content-Disposition, etc.).
Messages which contain these headers multiple times should be rejected for security reasons.

Content-Length injection leads to response splitting
Location leads to redirect hijacking.