How to get the origin of a form in cgi python?

Question

Hello, I’m using python with cgi, for my forms. I need to get origin to make sure my website is safe, but I couldn’t find any information on it. The only thing I am doing for now is to recover the data that comes via post or via get:

#!/usr/bin/python2.7

import cgi
form = cgi.fieldStorage()

# pego uma opcao do post assim:
nome=""
if "nome" in form:
   nome=form["nome"].value

So, does anyone know which command I use to retrieve origin(the site where the form is coming from to access this page)?

Answer 1

Short answer - but read below!!!

import os
origin = os.environ.get("REMOTE_HOST")

Some considerations: Pure CGI is not an interesting technology to be used in 2018. It was implemented in the "pre-web 1.0" times - in addition to drastic performance problems, it is a time when "all web applications have to implement everything": make by themselves all the session code, security, check entry, manually map your data to Python objects, write them to the database (or other means)

From the time when CGI was used most commonly for today’s complexity - and forms of attack on - WEB applications were multiplied by more than 100 times. As an example, a CGI request creates a new process, with a new Python interpreter, for each page request via HTTP. Already about 10 years ago even using a system thread (reusing the Python interpreter and the process) is considered "Overkill" - although it is still ok for apps without much traffic.

Understand what happens: the CGI engines of the web server fill the environment variable "REMOTE_HOST" with the contents of the HTTP "Origin" field. (You might even call cgi.print_environ_usage() to see other interesting environment variables).

However, as a "security mechanism", this variable and nothingness are the same thing. The "Origin" field is placed in the http header - in the normal operation of the application, this is done by the user’s browser, which fills the field with the domain on the site. However, anyone connected to the internet can make a "post" or "get" request to your server by filling in the http headers, including "origin" as they wish. This is actually one of the features of the http protocol, as it allows the implementation of Apis.

When creating a web application you have to be aware that anything that arrives on your server can come from anywhere on the internet, and with any content.

The only thing that can be guaranteed is that, at some point, before sending you a response, the HTTP client made some other request to your server (for example, to retrieve the html from the form itself) - this is done by using cryptographic tokens. But keep in mind that the entire code of the page is under third party control: can not guarantee any restriction of the values sent by the client, validation or anything: the client "browser" is free to create a completely arbitrary "POST" for your application.

Over decades (decades after the creation of CGI, by the way) of web applications, web frameworks have evolved, incorporating code that either implements alone, or encourages the use, of good security practices. The type of "attack" you are thinking of, for example, is mitigated by the use of "Cross Site Request Forgery" token Verification, and is put into (almost) automatic form by all frameworks in active development. And it is an "attack", unlike an arbitrary "POST" made by an API, why it could be used to embed posts to your site from javascript maliciously embedded in any other web page - so a user of your site who visited the other page could have the data stolen or tampered with.

So the recommendation is: Okay play a little with CGI to understand the mechanisms. But, as soon as possible, and especially, don’t put any applications on the air: use a web framework like flask, Django, Bottle and Python 3 (Python 2 is also an obsolete technology that is to be completely retired. If your computer is a Linux, Python 3 is available simply by typing "python3" instead of Python)