day36 cookies&session

区别

1.cookies在客户端，session在服务器端

2.联系，session是人为建立的，通过cookies构建出来的，每次用户来的时候给他发一段token，下次再来的时候如果还是上次的token就认为还是上次的

分页

XSS跨站脚本攻击

csrf跨站请求伪造，用于post ，工作原理

AJAX

　　iframe

　　xmlhttprequest

　　jquery

$.ajax({

url:

type:

data:

dataType:

success:

error:

})

AJAX上传文件

 1 <!DOCTYPE html>
 2 <html>
 3 <head lang="en">
 4     <meta charset="UTF-8">
 5     <title></title>
 6 </head>
 7 <body>
 8     <input type="file" id="img" />
 9     <input type="button" onclick="UploadFile();" />
10     <script>
11         function UploadFile(){
12             var fileObj = $("#img")[0].files[0];
13             var form = new FormData();
14             form.append("k1", "v1");
15             form.append("fff", fileObj);
16 
17             $.ajax({
18                 type:'POST',
19                 url: '/index',
20                 data: form,
21                 processData: false,  // tell jQuery not to process the data
22                 contentType: false,  // tell jQuery not to set contentType
23                 success: function(arg){
24                     console.log(arg);
25                 }
26             })
27         }
28     </script>
29 </body>
30 </html>
31 
32 HTML - jQuery

ajax上传文件

2017-7-8 15:45:30

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.web
import tornado.ioloop

class Indexhandler(tornado.web.RequestHandler):
    def get(self):
        self.set_cookie('k1','999')
        ret = self.cookies
        print(ret)
        self.render('index.html')

settings={
    "template_path":'views'

}
app=tornado.web.Application({
    (r'/index',Indexhandler),
},**settings)

if __name__=='__main__':
    app.listen('8888')
    tornado.ioloop.IOLoop.instance().start()

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <div style="color: #c03945;">cookies</div>

    <script>
        function setCookie(name,value,expires){
            var current_date = new Date();
            current_date.setSeconds(current_date.getSeconds() + 5);
            document.cookie = name + "= "+ value +";expires=" + current_date.toUTCString();
}
    </script>
</body>
</html>

index.html

    $.cookie('k1','666',{expires:7}) 
//这是保存七天的
    var current_data=new Data();
    current_data.setSeconds(current_data.getSeconds()+6)
    $.cookie('k1','666',{expires:current_data})
// 这是保存6秒的

setcookie by day or sec

（2017-7-9 10:32:00）

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
container={}
class Indexhandler(tornado.web.RequestHandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
            import hashlib,time
            obj=hashlib.md5()
            obj.update(bytes(str(time.time()),encoding='utf8'))
            random_str=obj.hexdigest()
            container[random_str]={}
            container[random_str]['k1']=666
            container[random_str]['k2']=self.get_argument('u',None)+'parents'
            container[random_str]['is_login']=True
            self.set_cookie('sess',random_str)
            print(container)
        else:
            self.write('please login')
class Managerhandler(tornado.web.RequestHandler):
    def get(self, *args, **kwargs):
        random_str=self.get_cookie('sess')
        current_uinfo=container.get(random_str,None)
        if not current_uinfo:
            self.redirect('/index')
        else:
            if current_uinfo.get('is_login',None):
                temp='%s--%s' %(current_uinfo.get('k1',''),current_uinfo.get('k2',''))
                self.write(temp)
            else:
                self.redirect('/index')

settings={
    'template_path':'views'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
])


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

session1

(2017-7-10 15:44:33)

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib, time

container={}
class Session:
    def __init__(self,handler):
        self.handler=handler
        self.random_str=None

    def __generate_random_str(self):
        obj=hashlib.md5()
        obj.update(bytes(str(time.time()),encoding='utf8'))
        random_str=obj.hexdigest()
        return random_str

    def set_value(self,key,value):
        if not self.random_str:
            random_str=self.handler.get_cookie('wolala')
            if not random_str:
                #random_str不存在就生成一个
                #{'b7a99d741b7bd1ba2c1b64282bc93711': {'name': 'alex', 'is_login': True}}
                random_str=self.__generate_random_str()
                container[random_str]={}
            else:
                #random_str存在就
                if random_str in container.keys():
                    pass
                else:
                    random_str=self.__generate_random_str()
                    container[random_str]={}
            self.random_str=random_str
        container[self.random_str][key]=value
        self.handler.set_cookie('wolala',self.random_str)

    def get_value(self,key):
        random_str=self.handler.get_cookie('wolala')
        print('random_str',random_str)
        if not random_str:
            return None
        user_info_dict=container.get(random_str,None)

        if not user_info_dict:
            return None
        value=user_info_dict.get(key,None)
        return value

class Indexhandler(tornado.web.RequestHandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
           s=Session(self)
           s.set_value('is_login',True)
           s.set_value('name',self.get_argument('u',None))
           print(container)
           self.write('has logined')
        else:
            self.write('please login')
class Managerhandler(tornado.web.RequestHandler):
    def get(self):
        s=Session(self)
        val=s.get_value('is_login')
        # print(1, val,s.get_value('name'))
        if val :
            self.write(s.get_value('name'))

        else:
            self.write('failure')

settings={
    'template_path':'views'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
])


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

session3

2017-7-10 16:18:00

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib, time

container={}
class Basehandler(tornado.web.RequestHandler):
    def __init__(self):
        self.session=Session(self)
class Session:
    def __init__(self,handler):
        self.handler=handler
        self.random_str=None

    def __generate_random_str(self):
        obj=hashlib.md5()
        obj.update(bytes(str(time.time()),encoding='utf8'))
        random_str=obj.hexdigest()
        return random_str

    def __setitem__(self, key, value):
        random_str=self.handler.get_cookie('wolala')
        if not random_str:
            #random_str不存在就生成一个
            #{'b7a99d741b7bd1ba2c1b64282bc93711': {'name': 'alex', 'is_login': True}}
            random_str=self.__generate_random_str()
            container[random_str]={}
        else:
            #random_str存在就
            if random_str in container.keys():
                pass
            else:
                random_str=self.__generate_random_str()
                container[random_str]={}
        self.random_str=random_str
        container[self.random_str][key]=value
        self.handler.set_cookie('wolala',self.random_str)

    def __getitem__(self,key):
        random_str=self.handler.get_cookie('wolala')
        print('random_str',random_str)
        if not random_str:
            return None
        user_info_dict=container.get(random_str,None)

        if not user_info_dict:
            return None
        value=user_info_dict.get(key,None)
        return value

class Indexhandler(Basehandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
           self.session['is_login']=True
           self.session['name']=self.get_argument('u',None)
           print(container)
           self.write('has logined')
        else:
            self.write('please login')
class Managerhandler(Basehandler):
    def get(self):
        val=self.session['is_login']

        if val :
            self.write(self.session['name'])

        else:
            self.write('failure')

settings={
    'template_path':'views'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
])


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

完整版session

更正session（2017-7-12 14:10:22）

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib, time

container={}
class Basehandler(tornado.web.RequestHandler):
    def initialize(self):
        self.session=Session(self)
class Session:
    def __init__(self,handler):
        self.handler=handler
        self.random_str=None

    def __generate_random_str(self):
        obj=hashlib.md5()
        obj.update(bytes(str(time.time()),encoding='utf8'))
        random_str=obj.hexdigest()
        return random_str

    def __setitem__(self, key, value):
        random_str=self.handler.get_cookie('wolala')
        if not random_str:
            #random_str不存在就生成一个
            #{'b7a99d741b7bd1ba2c1b64282bc93711': {'name': 'alex', 'is_login': True}}
            random_str=self.__generate_random_str()
            container[random_str]={}
        else:
            #random_str存在就
            if random_str in container.keys():
                pass
            else:
                random_str=self.__generate_random_str()
                container[random_str]={}
        self.random_str=random_str
        container[self.random_str][key]=value
        self.handler.set_cookie('wolala',self.random_str)

    def __getitem__(self,key):
        random_str=self.handler.get_cookie('wolala')

        if not random_str:
            return None
        user_info_dict=container.get(random_str,None)

        if not user_info_dict:
            return None
        value=user_info_dict.get(key,None)
        return value

class Indexhandler(Basehandler):
    def get(self):
        print('get')
        if self.get_argument('u',None) in ['alex','eric']:
           self.session['is_login']=True
           print('islogin')
           self.session['name']=self.get_argument('u',None)
           print(container)
           self.write('has logined')
        else:
            self.write('please login')
class Managerhandler(Basehandler):
    def get(self):
        val=self.session['is_login']
        if val :
            self.write(self.session['name'])
        else:
            self.write('failure')

settings={
    'template_path':'views'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
])


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

session

验证码（2017-7-12 14:10:05）

要install pillow module

并且把checkcode.py 放在里面

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib, time

container={}
class Basehandler(tornado.web.RequestHandler):
    def initialize(self):
        self.session=Session(self)
class Session:
    def __init__(self,handler):
        self.handler=handler
        self.random_str=None

    def __generate_random_str(self):
        obj=hashlib.md5()
        obj.update(bytes(str(time.time()),encoding='utf8'))
        random_str=obj.hexdigest()
        return random_str

    def __setitem__(self, key, value):
        random_str=self.handler.get_cookie('wolala')
        if not random_str:
            #random_str不存在就生成一个
            #{'b7a99d741b7bd1ba2c1b64282bc93711': {'name': 'alex', 'is_login': True}}
            random_str=self.__generate_random_str()
            container[random_str]={}
        else:
            #random_str存在就
            if random_str in container.keys():
                pass
            else:
                random_str=self.__generate_random_str()
                container[random_str]={}
        self.random_str=random_str
        container[self.random_str][key]=value
        self.handler.set_cookie('wolala',self.random_str)

    def __getitem__(self,key):
        random_str=self.handler.get_cookie('wolala')
        print('random_str',random_str)
        if not random_str:
            return None
        user_info_dict=container.get(random_str,None)

        if not user_info_dict:
            return None
        value=user_info_dict.get(key,None)
        return value

class Indexhandler(Basehandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
           self.session['is_login']=True
           self.session['name']=self.get_argument('u',None)
           print(container)
           self.write('has logined')
        else:
            self.write('please login')
class Managerhandler(Basehandler):
    def get(self):
        val=self.session['is_login']

        if val :
            self.write(self.session['name'])

        else:
            self.write('failure')

class Loginhandler(Basehandler):
    def get(self):
        self.render('login.html',statu='')
    def post(self, *args, **kwargs):
        user=self.get_argument('user',None)
        pwd=self.get_argument('password',None)
        security=self.get_argument('security',None)
        print(security,'secu')
        checkcode=self.session['security']
        if security.upper()==checkcode.upper():
            self.write('correct')
        else:
            self.render('login.html',statu='wrong code')

class Checkcodehandler(Basehandler):
    def get(self, *args, **kwargs):
        import io
        import check_code
        mstream=io.BytesIO()
        img,code=check_code.create_validate_code()
        img.save(mstream,'GIF')
        self.write(mstream.getvalue())
        self.session['security']=code
        print(container)


settings={
    'template_path':'views'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
    (r'/login',Loginhandler),
    (r'/check_code',Checkcodehandler),

],**settings)


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

scode

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
        <form action="/login" method="post">
            <p><input name='user' type="text" placeholder="user"> </p>
            <p><input name="password" type="text" placeholder="password"> </p>
            <p><input name="security" type="text" placeholder="security">
            <img src="/check_code" onclick="Changecode();" id="imgcode"></p>
            <input type="submit" value="submit">
            <span>{{statu}}</span>

        </form>
<script>
    function Changecode() {
        var code=document.getElementById('imgcode');
        code.src+='?'
    }
</script>
</body>
</html>

Ajax跨域请求（2017-7-13 11:16:04）

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <form action="/xsrf" method="post">
    <span>{% raw xsrf_form_html() %}</span>
        <!--这样可以隐藏这个数据-->
    </form>
    <button value="aj xsrf" onclick="Xsrf();">submit</button>
    <input type="submit" value="submittt">
<script src="/statics/jquery-3.1.1.js"></script>
<script>
    function getCookie(name) {
        var r = document.cookie.match("\\b" + name + "=([^;]*)\\b");
        return r ? r[1] : undefined;
}
    function Xsrf() {
        var nid=getCookie('_xsrf');
        $.post({
            url:'/xsrf',
            data:{'k1':'v1','_xsrf':nid},
            success:function (callback) {
//                发送成功后自动执行内容
//                callback会返回服务器write的数据
                console.log(callback)
            }

        })
    }
</script>
</body>
</html>

xsrf.html

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib, time

container={}
class Basehandler(tornado.web.RequestHandler):
    def initialize(self):
        self.session=Session(self)
class Session:
    def __init__(self,handler):
        self.handler=handler
        self.random_str=None

    def __generate_random_str(self):
        obj=hashlib.md5()
        obj.update(bytes(str(time.time()),encoding='utf8'))
        random_str=obj.hexdigest()
        return random_str

    def __setitem__(self, key, value):
        random_str=self.handler.get_cookie('wolala')
        if not random_str:
            #random_str不存在就生成一个
            #{'b7a99d741b7bd1ba2c1b64282bc93711': {'name': 'alex', 'is_login': True}}
            random_str=self.__generate_random_str()
            container[random_str]={}
        else:
            #random_str存在就
            if random_str in container.keys():
                pass
            else:
                random_str=self.__generate_random_str()
                container[random_str]={}
        self.random_str=random_str
        container[self.random_str][key]=value
        self.handler.set_cookie('wolala',self.random_str)

    def __getitem__(self,key):
        random_str=self.handler.get_cookie('wolala')
        print('random_str',random_str)
        if not random_str:
            return None
        user_info_dict=container.get(random_str,None)

        if not user_info_dict:
            return None
        value=user_info_dict.get(key,None)
        return value

class Indexhandler(Basehandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
           self.session['is_login']=True
           self.session['name']=self.get_argument('u',None)
           print(container)
           self.write('has logined')
        else:
            self.write('please login')
class Managerhandler(Basehandler):
    def get(self):
        val=self.session['is_login']

        if val :
            self.write(self.session['name'])

        else:
            self.write('failure')

class Loginhandler(Basehandler):
    def get(self):
        self.render('login.html',statu='')
    def post(self, *args, **kwargs):
        user=self.get_argument('user',None)
        pwd=self.get_argument('password',None)
        security=self.get_argument('security',None)
        print(security,'secu')
        checkcode=self.session['security']
        if security.upper()==checkcode.upper():
            self.write('correct')
        else:
            self.render('login.html',statu='wrong code')

class Checkcodehandler(Basehandler):
    def get(self, *args, **kwargs):
        import io
        import check_code
        mstream=io.BytesIO()
        img,code=check_code.create_validate_code()
        img.save(mstream,'GIF')
        self.write(mstream.getvalue())
        self.session['security']=code
        print(container)
#给他写一个类
class Csrfhandler(Basehandler):
    def get(self):
        self.render('xsrf.html')
    def post(self, *args, **kwargs):
        #只能用post的方式提交
        self.write('seeing directry')

settings={
    'template_path':'views',
    'xsrf_cookies':True ,
    # 'static_path':'statics',
    'static_url_prefix':'/statics/'
}

app=tornado.web.Application([
    (r'/index',Indexhandler),
    (r'/manager',Managerhandler),
    (r'/login',Loginhandler),
    (r'/check_code',Checkcodehandler),
    (r'/xsrf',Csrfhandler),#在这里要加这个

],**settings)


if __name__=='__main__':
    app.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

socde

上传文件（2017-7-14 15:20:54）

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.web
import tornado.ioloop

class Indexhandler(tornado.web.RequestHandler):
    def get(self):
        self.set_cookie('k1','999')
        ret = self.cookies
        print(ret)
        self.render('ajaxindex.html')
    def post(self, *args, **kwargs):
        print(self.get_argument('user'))
        print(self.get_arguments('fa'))

        self.write('ssssssssss')
        file_data=self.request.files["fff"]
        print(file_data)
        for f in file_data:
            file_name=f['filename']
            with open(file_name,'wb') as fw:
                fw.write(f['body'])


settings={
    "template_path":'views',
    "static_url_prefix":'/statics/',

}
app=tornado.web.Application({
    (r'/index',Indexhandler),
},**settings)

if __name__=='__main__':
    app.listen('8888')
    tornado.ioloop.IOLoop.instance().start()

uploadfile

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <form action="/index" method="POST" enctype="multipart/form-data">
        <!--发送文件要写enctype="multipart/form-data"-->
        <input type="text" name="user">
        <h3>hobbit</h3>
        <input name="fa" value="1" type="checkbox">basketball
        <input name="fa" value="2" type="checkbox">football
        <input name="fa" value="3" type="checkbox">glassball


        <input type="submit" value="sub">
        <input type="file" name="fff">

    </form>
    <p>
        <input type="button" onclick="Xmlsendrequest();" value="ajaxrequest">
    </p>
    <script type="text/javascript" src="/statics/jquery-3.1.1.js"></script>

    <script>
        function Xmlsendrequest() {
            $.ajax({

            })
        }
    </script>
</body>
</html>

ajaxhtml

iframe兼容性更好的上传文件(2017-7-14 16:07:32)

#! bin/usr/evn python
# -*- coding:utf-8 -*-
import tornado.web
import tornado.ioloop

class Indexhandler(tornado.web.RequestHandler):
    def get(self):
        self.render('iframeupload.html')
    def post(self, *args, **kwargs):
        file_data=self.request.files["fff"]
        print(file_data)
        for f in file_data:
            file_name=f['filename']
            with open(file_name,'wb') as fw:
                fw.write(f['body'])


settings={
    "template_path":'views',
    "static_url_prefix":'/statics/',
    # 'static_path':'statics'

}
app=tornado.web.Application({
    (r'/index',Indexhandler),
},**settings)

if __name__=='__main__':
    app.listen('8888')
    tornado.ioloop.IOLoop.instance().start()

View Code

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <style>
        .hide{
            display: none;
        }
    </style>
    
</head>
<body>
     <form id="my_form" name="form" action="/index" method="POST"  enctype="multipart/form-data" >
        <div id="main">
            <input name="fff" id="my_file"  type="file" />
            <input type="button" name="action" value="Upload" onclick="redirect()"/>
            <iframe id='my_iframe' name='my_iframe' src=""  class="hide"></iframe>
        </div>
    </form>
    <script src="/statics/jquery-3.1.1.js"></script>
    <script>
        function redirect(){
//            document.getElementById('my_iframe').onload = Testt;
            document.getElementById('my_form').target = 'my_iframe';
            document.getElementById('my_form').submit();

        }

//        function Testt(ths){
//            var t = $("#my_iframe").contents().find("body").text();
//            console.log(t);
//        }
    </script>
</body>
</html>

html

posted @ 2017-07-08 15:46 ezway 阅读(200) 评论(0) 编辑收藏举报

会员力量，点亮园子希望

刷新页面返回顶部

ezway

day36 cookies&session

公告