Identify network devices

[LemonParty]

When I call

Code: Pascal  [Select][+][-]

1. TFPHttpServer.Active:= True

the execution stops.
Is it a necessary to put TFPHttpServer into a separate thread?
Can I use a different port (other than 443)? Will it still work with SSL?
What hash algorithm better fits for hashing passwords?

[dbannon]

The server is (probably) not stopped, its waiting for a request.  Normally, your server spends much of its waiting. There is a method, OnIdle() ? that you can do things like watch for a shutdown signal. But if you really do need to go off doing something else, yep a thread, or, perhaps better, a separate process.

Here are some instructions I supply my end user about how to generate a self signed certificate (amongst other things) -
https://github.com/tomboy-notes/tomboy-ng/tree/master/experimental/Misty-Small

Davo

[LemonParty]

One more question.
If I create an unique identifer to identify machine. How then I should pass this identifer in browser?

[cdbc]

Hi
I think browsers only accept strings... I dunno, maybe base64?!?
Regards Benny

[LeP]

One more question.
If I create an unique identifer to identify machine. How then I should pass this identifer in browser?

Do you mean how a normal browser can use your identifier and send it to your server ?

It's unthinkable for a normal browser to send something it doesn't have available unless you modify all your clients with a specific setting.

Generally, if you want the browser to send something to the machine-dependent server, you must use or maintain something on the client's machine.

Alternatively, you must send something from the server to the client (browser) that allows it to process or retrieve that "unique identifier."
But we're back to square one: if that identifier can be derived directly from the normal information sent by any browser, there's no problem (you process it and retrieve it server-side). If, however, you need to process it client-side, you must use JavaScript or something else (web assembly, for example). Your server will send it (the javascript routine or webassembly) to the client browser, and the client browser will return the information obtained.

This process is essentially the same as managing cookies.

Take care of security ... normal javascript can be spoofed.

[dbannon]

One more question.
If I create an unique identifer to identify machine. How then I should pass this identifer in browser?

No, no more questions until you answer at least the one I asked on the previous page.

Are you connecting as a web service where you have control of the client ?   Or just using browsers to connect ?

The answer to your questions depend heavily on what you are trying to do.

Davo

[Thaddy]

+1 Davo

[LemonParty]

dbannon, what do you mean by have control of the client?
I want to be able to login from browser and then be able to access protected content safely.
I think I should use a cookie to safe the unique identifer.

[LemonParty]

It is a list of properties that contain "cookie". Which one use to add the cookie to responce?

[dbannon]

dbannon, what do you mean by have control of the client?
I want to be able to login from browser and then be able to access protected content safely.
I think I should use a cookie to safe the unique identifer.

OK, if just using a browser at the client end, no, you cannot, for example send a code for the server to remember.  How do you plan to check that anyone who comes along cannot connect ?  I am afraid you will need a proper authentication process here. Server to send back a page (javascript or what every) that asks for a user name and password. Maybe you have a list of those user names and passwords in your server code ?  Probably that is the minimal way to do it.

You used to be able to put a user name and password in the URL but I suspect that approach has not been supported for some time.

Probably someone else will be more helpful than me ...

Davo

[dbannon]

It is a list of properties that contain "cookie". Which one use to add the cookie to responce?

If the server sends you back a cookie, it will send one back to everyone who connects. Don't think that is what you want.

Davo

[LemonParty]

I do the authentication process and as a result I send a session ID.
I have tryied this three variants to set up the cookies:

Code: Pascal  [Select][+][-]

1. AResponse.CookieFields.Add('sid=' + ToHex(UserSIDs[ID]));
2. AResponse.Cookie:= 'sid=' + ToHex(UserSIDs[ID]);
3. AResponse.SetCookie:= 'sid=' + ToHex(UserSIDs[ID]);

None of them not work.

Then I found on Internet this code:

Code: Pascal  [Select][+][-]

1. AResponse.CustomHeaders.Add('Set-Cookie: sid=' + ToHex(UserSIDs[ID]) + '; path=/; HttpOnly');

And this thing actually set up the cookies, but there is a problem. This is how the cookie look in browser (see the screenshot).
Why there is no name?

[LemonParty]

I found a correct approach.
This code works as needed:

Code: Pascal  [Select][+][-]

1. with AResponse.Cookies.Add do begin
2.   Name:= 'sid';
3.   Value:= ToHex(UserSIDs[ID]);
4.   Path:= '/';
5.   HttpOnly:= True;
6. end;

[Warfley]

Honestly, from reading this and your other threads I would recommend you maybe start of with building a first web app with something more well designed for web like PHP.
Building a webserver with FCL-Web is very hard. Development and Deployment are really complicated, you can choose between using the fpc stable version, which is hopelessly outdated, or the fpc trunk, which is in active development and you can get lots of bugs, so neither is really desirable. As it is just a very small development team you might not have all the features, or you have not patched bugs being in some not so well tested functionality, etc.

You must deal with all of that, while you simultaneously have no idea how web development works in the first place, which is also quite tricky. Like HTTP is not really a complicated protocol, but different browsers may have slight differences (e.g. HTTP header casing) making it in practice really difficult.
Combine this with the fact that you are in an hostile environment. When looking into the logs of my server, there are thousands of bots trying to "hack" into it every day. Every mistake you make could lead to your server being infected with malware. And FPC as a unsafe language is not that well suited for such security critical areas.

And this is not even speaking about the most difficult part that is designing your software. HTTP is stateless, so you need to work around singe request response patterns all the time, which is different from how normal applications are designed. You can have your usual web requests by browsers but also AJAX in between where you have to communicate with a custom Javascript client, which may also act differently.
If you are doing authentication (as you describe here), building a well designed authentication system is not that easy either and there are a bunch of traps you can fall into. Building a reliable and secure backend system is very difficult even without all the technical issues you get from using FCL-Web.

The most common languages for web development are Python, Javascript and PHP for a reason. They have extensive frameworks and are easy to deploy. You find tones for resources how to work with them. This allows you to first focus.

I personally used FCL-Web quite a bit in the past. It can be worked with if you get to know it a bit. But I usually only use it when I need to use functionality that I have already pascal code for, and I don't want to rewrite it.
Other than that it is just not worth it to use Pascal over something with a better framework and ecosystem (my goto is PHP or Java). And especially not if you not just have to learn how to deal with fcl-web, but also have to learn everything else from scratch as well

[LemonParty]

Warfley, why Pascal is unsafe language?
Python, Javascript and PHP there is a problem with all described languages. They all are sometimes extremely slow. I built some time ago an application with JS that working a lot with strings and performance and resource usage was absolutely disappointing. Warfley, what do you say about Rust, is it safe enough for web servers?