Unit 2: URLs, methods and redirects · Lesson 1 of 5 · 18 min
Anatomy of a URL
Scheme, host, port, path, query and fragment, and which ones the server ever sees.
mission
- You are
- The analyst reviewing the shop's search page.
- Situation
- Support says searching for two words sometimes returns nothing. Before blaming the app, you check what the browser actually sends.
- Goal
- Send search queries with and without encoding and compare the request lines.
- Hand in
- The exact request line for a two-word search.
A URL as a shipping label
Search for one word
curl -s 'http://127.0.0.1:8000/search?q=lock'
{"query": "lock", "count": 2, "results": ["Padlock", "Cable lock"]}
you should see JSON with a count and the matching products.
Search for two words, encoded
-G turns --data-urlencode values into the query string and encodes them for you.
curl -s -G --data-urlencode 'q=cable lock' http://127.0.0.1:8000/search
{"query": "cable lock", "count": 1, "results": ["Cable lock"]}
you should see One result. The space survived the trip.
See what was really sent
curl -sv -G --data-urlencode 'q=cable lock' http://127.0.0.1:8000/search 2>&1 | grep '^> GET'
> GET /search?q=cable+lock HTTP/1.1
you should see The space travels as +.
defender tip Characters such as &, # and ? change how a URL is read. When a value contains them unencoded, the server parses a different request from the one the user meant.
Watch the fragment stay home
Everything after # belongs to the browser. It is never sent.
curl -sv 'http://127.0.0.1:8000/search?q=safe#results' 2>&1 | grep '^> GET'
> GET /search?q=safe HTTP/1.1
you should see No #results in the request line.
Where secrets do not belong
GET /account?token=8f2c91d4 HTTP/1.1
Ends up in history, server logs, proxies and Referer headers.
GET /account HTTP/1.1 Authorization: Bearer 8f2c91d4
Not logged by default and never sent to other sites.
What a defender takes away
- 1Scheme, host and port pick the server; path and query pick the page; the fragment never leaves the browser.
- 2Encode values before they go into a query string.
- 3Never put tokens or passwords in a URL.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.