ITEC 325 2018spring ibarland

home—lects—hws
D2L—breeze (snow day)

intro: web requests and responses

Recall: In essence, a web-server and web-browser are each functions with the type-signatures:
server : string → string (or, if you have very specific classes, Url → HtmlStr)
browser : string → void (or HtmlDoc → void).

video: inside http headers (19m54s)

As the video is playing, follow along and be looking at the developer-tools yourself.

Errata: Places where I misspoke, in the video:
06:48 The “Host:” field is just the sever's name (separate from the rest of the URL)
09:38 A better example where knowing user-agent is helpful to server: software-download pages can know what version to suggest.
09:48 “maybe the browserserver could give back a different response, based on which browser I'm using”
15:52 “on future responsesrequests”

Looking more closely

For this class, you'll need a browser with good debug-tools built in. For Firefox, there is an extension “Firebug”; I'll demo a couple of Chrome's built-in tools. We will not worry about supporting old browers (e.g. old versions of IE).

≡ » More Tools » Developer Tools
We’ll look briefly at the Elements tab, but today we're mostly concerned with the Network tab, and clicking on particular files. (You might need to click on View » Hide Overview.) In particular, viewing the Request Headers and Response Headers.

Together in class: Spend 15min looking at examples.

Btw, here are the official HTTP response codes, or the cat-picture version.

the real upshot: So, the essence of the situation is actually that the server and browser are functions with the type-signatures:
server: http-request-packet → http-response-packet (where the first packet contains the URL, and the second packet contains the html response);
browser: http-response-packet → void (changing pixels on a screen, as side-effect).¹

Further things to consider (if not today, then perhaps later:)

• starting up at Starbucks, when you get 'welcome to our wireless; please agree to our terms'.
• telling my phone to use RUWireless, even not in browser a page comes up w/ "please authenticate"
• Q: are URLs case-sensitive? How might you experiment, to find out?
• What is the file that gets looked up, by the www.radford.edu web server? By php.radford.edu ?
• sites that pop up 20 other windows (usually adverts)? Whose fault is that?
• Referring page is often provided, when making a request. How is this a security leak?
  An actual example: Suppose a hiring committee has a wiki with their comments, and use “privacy through obfuscation”: they don't set up a password, but they do use an un-guessable URL.
• When you start typing a google-request, it auto-completes. What's happening? (What info is being sent, and when?)

        - ACTUAL: server-side computation (via Ajax):
               on each keystroke, a transaction is happening, and google.com computes the completion
               (for *every* google visitor in the world, yikes, is that a lot of bandwidth?)
  
        - What are some other *hypothetical* was this could be handled?
          - client-side: the server includes the top 10,000 most popular searches,
              and the client javascript uses that to determine the auto-completion.
              (This wouldn't explain the .)
  
            That would be an expensive load-time on every page!  How might we use this approach but
              try to avoid having 'google.com' be a huge download every time?
  
            How about: only include that dictionary on the *first* visit to google.com,
              and have the client javascript write it to a file;
              then on subsequent visits this
  
            This requires something additional though: How does google know if this is the *first*
              time I'm visiting, or if I've visited previously and therefore I already have 
              the set of common-searches cached?
              We'll discuss cookies later, which solve this.
          
            

• How do ad blockers work? ad blockers attack, and counter-attacks
• Every year, all VA state employees have to take an annoying on-line security quiz, and you have to click through screens before getting to the quiz, and then any wrong answer sends you back.
  How to slightly get around this, by using developer-tools to ferret out the real URL, letting me go straight to the quiz-questions: va.moatusers.com/Mod_viewer.asp?ID=83529&calledby=&Orgnum=0&mhid=574&lhid=1470&pagenum=2
  (Note that I still need to log on first, and there is still a cookie that is happening/needed, so it can record my answers under my username.)

home—lects—hws
D2L—breeze (snow day)

This page licensed CC-BY 4.0 Ian Barland Page last generated 2018.Jan.20 (Sat)

Please mail any suggestions (incl. typos, broken links) to ibarlandradford.edu