Writing an HTTP server from scratch
You grasp the protocol at the lowest level by writing an HTTP/1.1 parser, a router, a static file server and concurrent connection handling with Python sockets.
Level 501 · 15 lessons · 12 practice labs
Lessons
From sockets to parsing
- A TCP socket server: listening and accepting
- Parsing the request line and headers
- Reading the body: Content-Length and chunked transfer
- Producing a well-formed response
- Short task: a server that echoes the request
Towards a real server
- Serving static files and preventing path traversal
- A router and handlers
- Persistent connections (keep-alive)
- Concurrency: threads and asyncio
- Size limits and timeouts
- Short task: test your server with curl and a browser
Hardening
- Surviving malformed input: fuzz testing
- Logging and a simple metrics endpoint
- Load testing and finding the bottleneck
- Capstone: serve a site with your own server
Practice labs
- Echo the request back: Write a small Python socket server that sends the incoming request lines back as the body.
- Parse headers into a dictionary: Write a parser that handles case, folded lines and repeated headers and pass the tests.
- Read a chunked body: Add code that joins Transfer-Encoding: chunked bodies and returns 400 on length errors.
- Serve static files: Add serving of files from the public folder with the correct Content-Type to your server.
- Block path traversal: Probe your server with ../ and encoded %2e%2e requests and stop any escape from the root.
- Add parameterised routes to a router: Write a router that matches paths like /products/:id and correctly tells 404 from 405.
- Support keep-alive: Add keep-alive so three back-to-back requests are answered on one connection and verify with curl.
- Serve many clients at once: Move the single-threaded server to asyncio and compare timings under 100 concurrent requests.
- Resist a slow-client attack: Cut off clients that trickle headers with timeouts and size limits and show the server keeps answering.
- Add a metrics endpoint: Write an endpoint that reports request count and mean duration as plain text at /metrics.
- Break your server with bad input: Fuzz your server with randomly mangled requests, find the input that crashes it and fix it.
- Find the bottleneck under load: Measure requests per second with a load tool, profile, improve the costliest function and measure again.
About this course
You grasp the protocol at the lowest level by writing an HTTP/1.1 parser, a router, a static file server and concurrent connection handling with Python sockets.
What you will learn
- From sockets to parsing
- Towards a real server
- Hardening
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.