DOCSLIB.ORG

Security Smells Pervade Mobile App Servers

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security Smells Pervade Mobile App Servers Security Smells Pervade Mobile App Servers Pascal Gadient Mohammad Ghafari Marc-Andrea Tarnutzer University of Auckland Oscar Nierstrasz Auckland, New Zealand Software Composition Group, University of Bern [email protected] Bern, Switzerland ABSTRACT channels has been built into recent releases of the Android ecosys- 3 [Background] Web communication is universal in cyberspace, and tem. Generally speaking, the existing literature has covered the security risks in this domain are devastating. [Aims] We analyzed transmitted payload by using client-side static [5] and dynamic the prevalence of six security smells in mobile app servers, and analysis techniques [12], server side analyses of web service source we investigated the consequence of these smells from a security code [9] as well as connection properties, e.g., the URL [16] or perspective. [Method] We used an existing dataset that includes two-factor authentication [13]. Another topic that has received 9 714 distinct URLs used in 3 376 Android mobile apps. We exercised extensive attention is that of hard-coded credentials in apps that these URLs twice within 14 months and investigated the HTTP may allow adversaries unrestricted access to the relevant infras- headers and bodies. [Results] We found that more than 69% of tested tructure [11, 15]. apps suffer from three kinds of security smells, and that unprotected Unfortunately, the server configurations of off-the-shelf applica- communication and misconfigurations are very common in servers. tion servers have received much less attention. A recent work has Moreover, source-code and version leaks, or the lack of update identified eight web API security smells, but did not assess their policies expose app servers to security risks. [Conclusions] Poor prevalence [3]. These smells are symptoms in the code that signal app server maintenance greatly hampers security. the prospect of a security vulnerability [4]. In this work we assess app servers that are used for communicating with mobile apps. We CCS CONCEPTS investigated the presence of six app server security smells, and the corresponding server maintenance activity based on the dataset • Security and privacy ! Web application security. that contains 9 714 distinct URLs that were used in 3 376 apps. We KEYWORDS address the following research questions: RQ1: What is the prevalence of the server side security smells in security smells, web communication, mobile apps the web communication of mobile apps? We found 231 URLs from ACM Reference Format: 44 apps that leak the source code of the web service implementa- Pascal Gadient, Marc-Andrea Tarnutzer, Oscar Nierstrasz, and Mohammad tion if processing errors occur. We can further confirm that most Ghafari. 2021. Security Smells Pervade Mobile App Servers. In ACM / IEEE app servers communicate with apps over insecure HTTP connec- International Symposium on Empirical Software Engineering and Measure- tions [10], and fail to enforce use of the HTTP strict transport ment (ESEM) (ESEM ’21), October 11–15, 2021, Bari, Italy. ACM, New York, security policy. Finally, we found that on average almost every NY, USA, 10 pages. https://doi.org/10.1145/3475716.3475780 second app server suffers from version information leaks. 1 INTRODUCTION RQ2: What is the relationship between security smells and app server maintenance? In particular, we are interested in configura- Globally accessible, reliable, and scalable web services are on the tion changes, because they provide insights into established main- 1 rise, with more than 24 000 currently known public web APIs. Like- tenance processes of mobile app servers. Based on the collected wise, native apps are starting to decline while web apps arise that HTTP header information from two measurements over 14 months, 2 depend on application servers. Additionally during the past years, we evaluated what software changes are introduced by system ad- the complexity of developing a web-enabled app has massively ministrators. We observed that servers are usually set up once and arXiv:2108.07188v1 [cs.CR] 16 Aug 2021 increased due to the growing number of involved application frame- never touched again, yielding severe security risks. For instance, works, programming languages, and supported device categories, criminals can attack outdated app servers by exploiting vulnerabil- e.g., desktops, notebooks, tablets, smartphones, and wearables. ities listed in public databases or illicit websites. On the positive Web communication has already received much attention in side, we noted that version upgrades are much more common than the security community, leading to improved tool support. For ex- version downgrades, and that developers occasionally use Cloud- ample, programs exist that can continuously monitor web APIs flare to protect their infrastructure against adversaries, especially to ensure that an app remains compliant with the API specifica- for non-JSON-based app servers. tion [14], and tool support to mitigate insecure communication In summary, this work reveals the prevalence of insecure app 1https://www.programmableweb.com/apis/directory server configurations accessed by Android mobile apps, and their 2https://www.forbes.com/sites/victoriacollins/2019/04/05/why-you-dont-need-to- maintenance protocol. The list of apps that we analyzed in this study make-an-app-a-guide-for-startups-who-want-to-make-an-app/ is available online,4 and we share the aggregated data for research ESEM ’21, October 11–15, 2021, Bari, Italy 2021. ACM ISBN 978-1-4503-8665-4/21/10...$15.00 3https://developer.android.com/training/articles/security-config https://doi.org/10.1145/3475716.3475780 4https://doi.org/10.6084/m9.figshare.14981061 ESEM ’21, October 11–15, 2021, Bari, Italy Pascal Gadient, Marc-Andrea Tarnutzer, Oscar Nierstrasz, and Mohammad Ghafari purposes on request due to the contained sensitive information sensitive user data. Issue: The access to sensitive data or actions is such as credentials, API keys, and email addresses. not restricted by a sane authentication mechanism such as a user The remainder of this paper is organized as follows. We report name and password pair, instead, easy-to-forge identifiers or no on app server security smells relevant for this work in Section 2. identification data at all are used to secure the access. Symptom: We describe the dataset used for our app server investigations in A server does not respond with the status code 401 Unauthorized Subsection 3.1. We provide the prevalence of app server security or 403 Forbidden. In other words, the server successfully responds smells in Subsection 3.2, and we shed light on server infrastructure without asking for any credentials. maintenance in Subsection 3.3. Finally, we recap the threats to validity in Section 4, and we summarize related work in Section 5. 2.5 Missing HTTPS redirects We conclude this paper in Section 6. We found servers that do not redirect clients to encrypted connec- 2 SECURITY SMELLS IN APP SERVERS tions although they would have been supported. Issue: App servers do not redirect incoming HTTP connections to HTTPS when legacy In this section, we briefly explain six of the eight security smells apps try to connect. Symptom: For an HTTP request, a server does that we identified in previous work [3]. The two remaining security not deliver an HTTP 3xx redirect message which points to the smells, i.e., Credential leak and Embedded languages are not within corresponding HTTPS implementation of the web application. For the scope of this study, because they require a deep understanding an HTTPS request, a server delivers a HTTP redirect message. of the app and the context where they occur. 2.6 Missing HSTS 2.1 Insecure transport channel HTTP header information is used to properly set up the connec- Web communication relies on HTTP or HTTPS; both variants exist tion by specifying various communication parameters, e.g., the in app server configurations. Issue: HTTP does not provide any acceptable languages, the used compression, or the enforcement of security; neither the address, nor the header information or the HTTPS for future connection attempts, a feature which is called payload are encrypted. Symptom: The URL begins with http://. HTTP Strict Transport Security (HSTS). HSTS provides protection against HTTPS to HTTP downgrading attacks, i.e., when a user 2.2 Disclosure of source code once accessed a web resource in a secure environment (at home Error messages leak valuable information regarding the implemen- or work), the client knows that the resource needs to be accessed tation of a running system. Issue: Error messages that include the only through HTTPS. If this is not possible, e.g., at an airport at relevant stack trace are transmitted as plain text in the server’s which an attacker tries to perform MITM attacks, the client will message response body. Such a message reveals information like display a connection error. Hence, HSTS should be used in combi- the used method names, line numbers, and file paths disclosing nation with HTTP to HTTPS redirects, because the HSTS header the internal file system structure and configuration of the server. is only considered to be valid when sent over HTTPS connections. Symptom: The returned HTTP body contains a stack trace or a code Issue: Servers either do not leverage the HSTS feature, or they snippet that shows the problematic code. The structure of such do not use the recommended parameters. Symptom: A server does data depends on the used framework, however terms related to not deliver the HTTP HSTS header Strict-Transport-Security: application crashes are common, e.g., “stack,” “trace,” and “error.” max-age=31536000; includeSubDomains for an HTTPS request. 2.3 Disclosure of version information 3 EMPIRICAL STUDY Besides useful connection parameters, HTTP headers leak infor- For this empirical study we evaluated all URLs from the dataset mation regarding the software architecture and configuration of a according to the security smell symptoms described in the previ- running system.
Load more

Recommended publications
  • Lightweight Django USING REST, WEBSOCKETS & BACKBONE
    Lightweight Django USING REST, WEBSOCKETS & BACKBONE Julia Elman & Mark Lavin Lightweight Django LightweightDjango How can you take advantage of the Django framework to integrate complex “A great resource for client-side interactions and real-time features into your web applications? going beyond traditional Through a series of rapid application development projects, this hands-on book shows experienced Django developers how to include REST APIs, apps and learning how WebSockets, and client-side MVC frameworks such as Backbone.js into Django can power the new or existing projects. backend of single-page Learn how to make the most of Django’s decoupled design by choosing web applications.” the components you need to build the lightweight applications you want. —Aymeric Augustin Once you finish this book, you’ll know how to build single-page applications Django core developer, CTO, oscaro.com that respond to interactions in real time. If you’re familiar with Python and JavaScript, you’re good to go. “Such a good idea—I think this will lower the barrier ■ Learn a lightweight approach for starting a new Django project of entry for developers ■ Break reusable applications into smaller services that even more… the more communicate with one another I read, the more excited ■ Create a static, rapid prototyping site as a scaffold for websites and applications I am!” —Barbara Shaurette ■ Build a REST API with django-rest-framework Python Developer, Cox Media Group ■ Learn how to use Django with the Backbone.js MVC framework ■ Create a single-page web application on top of your REST API Lightweight ■ Integrate real-time features with WebSockets and the Tornado networking library ■ Use the book’s code-driven examples in your own projects Julia Elman, a frontend developer and tech education advocate, started learning Django in 2008 while working at World Online.
    [Show full text]
  • WEB2PY Enterprise Web Framework (2Nd Edition)
    WEB2PY Enterprise Web Framework / 2nd Ed. Massimo Di Pierro Copyright ©2009 by Massimo Di Pierro. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the web at www.copyright.com. Requests to the Copyright owner for permission should be addressed to: Massimo Di Pierro School of Computing DePaul University 243 S Wabash Ave Chicago, IL 60604 (USA) Email: [email protected] Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created ore extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. Library of Congress Cataloging-in-Publication Data: WEB2PY: Enterprise Web Framework Printed in the United States of America.
    [Show full text]
  • Technology Adoption in Input-Output Networks
    A Service of Leibniz-Informationszentrum econstor Wirtschaft Leibniz Information Centre Make Your Publications Visible. zbw for Economics Han, Xintong; Xu, Lei Working Paper Technology adoption in input-output networks Bank of Canada Staff Working Paper, No. 2019-51 Provided in Cooperation with: Bank of Canada, Ottawa Suggested Citation: Han, Xintong; Xu, Lei (2019) : Technology adoption in input-output networks, Bank of Canada Staff Working Paper, No. 2019-51, Bank of Canada, Ottawa This Version is available at: http://hdl.handle.net/10419/210791 Standard-Nutzungsbedingungen: Terms of use: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Documents in EconStor may be saved and copied for your Zwecken und zum Privatgebrauch gespeichert und kopiert werden. personal and scholarly purposes. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle You are not to copy documents for public or commercial Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich purposes, to exhibit the documents publicly, to make them machen, vertreiben oder anderweitig nutzen. publicly available on the internet, or to distribute or otherwise use the documents in public. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, If the documents have been made available under an Open gelten abweichend von diesen Nutzungsbedingungen die in der dort Content Licence (especially Creative Commons Licences), you genannten Lizenz gewährten Nutzungsrechte. may exercise further usage rights as specified in the indicated licence. www.econstor.eu Staff Working Paper/Document de travail du personnel 2019-51 Technology Adoption in Input-Output Networks by Xintong Han and Lei Xu Bank of Canada staff working papers provide a forum for staff to publish work-in-progress research independently from the Bank’s Governing Council.
    [Show full text]
  • Introducing Python
    Introducing Python Bill Lubanovic Introducing Python by Bill Lubanovic Copyright © 2015 Bill Lubanovic. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://safaribooksonline.com). For more information, contact our corporate/ institutional sales department: 800-998-9938 or [email protected]. Editors: Andy Oram and Allyson MacDonald Indexer: Judy McConville Production Editor: Nicole Shelby Cover Designer: Ellie Volckhausen Copyeditor: Octal Publishing Interior Designer: David Futato Proofreader: Sonia Saruba Illustrator: Rebecca Demarest November 2014: First Edition Revision History for the First Edition: 2014-11-07: First release 2015-02-20: Second release See http://oreilly.com/catalog/errata.csp?isbn=9781449359362 for release details. The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Introducing Python, the cover image, and related trade dress are trademarks of O’Reilly Media, Inc. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While the publisher and the author have used good faith efforts to ensure that the information and instruc‐ tions contained in this work are accurate, the publisher and the author disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work.
    [Show full text]
  • Translate Toolkit Documentation Release 2.0.0
    Translate Toolkit Documentation Release 2.0.0 Translate.org.za Sep 01, 2017 Contents 1 User’s Guide 3 1.1 Features..................................................3 1.2 Installation................................................4 1.3 Converters................................................6 1.4 Tools................................................... 57 1.5 Scripts.................................................. 96 1.6 Use Cases................................................. 107 1.7 Translation Related File Formats..................................... 124 2 Developer’s Guide 155 2.1 Translate Styleguide........................................... 155 2.2 Documentation.............................................. 162 2.3 Building................................................. 165 2.4 Testing.................................................. 166 2.5 Command Line Functional Testing................................... 168 2.6 Contributing............................................... 170 2.7 Translate Toolkit Developers Guide................................... 172 2.8 Making a Translate Toolkit Release................................... 176 2.9 Deprecation of Features......................................... 181 3 Additional Notes 183 3.1 Release Notes.............................................. 183 3.2 Changelog................................................ 246 3.3 History of the Translate Toolkit..................................... 254 3.4 License.................................................. 256 4 API Reference 257 4.1
    [Show full text]
  • Confessions of an Online Stalker Acknowledgements
    CONFESSIONS OF AN ONLINE STALKER ACKNOWLEDGEMENTS The following text Confessions of an Online Stalker is my critical reflection on a 3-year research project titled Future Guides: From Information to Home carried out between 2010-2014 within the Norwegian Artistic Fellowship Programme, and around the Ber- gen Academy of Art and Design. A final exhibition of my artistic research,Your Revolu- tion Begins at Home, took place at the USF Gallery and Cinemateket in Bergen, Sep- tember 4-14, 2014. Throughout my artistic research project, I have been blessed with a succession of engaging discussion partners who have provided invaluable assistance in the development of my research. The generosity of their time and readiness to talk things through have helped me to develop and reflect on the artistic research methods used to carry out this work. The following texts take the form of a series of conversa- tions because the creation of the work takes place through a long process of discussion, debate, negotiation and reflection. As I refer to a statement made by Deleuze in my introduction, “Creation is all about mediators which means that you are always working in a group, within a dialogue.” Therefore, I would like to acknowledge the many inter- locutors who contributed throughout this long process. They are and in no particular order of importance: Ellen Røed, Frans Jacobi, Magnus Bärtås, Suzanna Milevska, Lina Selander, Marcos Garcia, Marta Peirano, Fré Sonneveld, Brendan Howell, Sadie Plant, Amanda Steggell, Jeremy Welsh, Pedro Gomez-Egaña, François
    [Show full text]
  • Book of Abstracts Ii Contents
    CHEP 2009 Saturday, 21 March 2009 - Friday, 27 March 2009 Prague Book of Abstracts ii Contents Site specific monitoring from multiple information systems – the HappyFace Project . 1 Advanced Data Extraction Infrastructure: Web Based System for Management of Time Series Data .......................................... 1 CMS Data Acquisition System Software ............................ 2 Monitoring the CMS Data Acquisition System ........................ 2 An Assessment of a Model for Error Processing in the CMS Data Acquisition System . 3 Control Oriented Ontology Language ............................. 4 FROG : The Fast & Realistic OpenGl Event Displayer .................... 4 Reliable online data-replication in LHCb ........................... 5 TMVA - The Toolkit for Multivariate Data Analysis ..................... 5 Migration of Monte Carlo Simulation of High Energy Atmospheric Showers to GRID In- frastructure ......................................... 5 Virtuality and Efficiency - Overcoming Past Antinomy in the Remote Collaboration Expe- rience ............................................ 6 High availability using virtualization ............................. 7 Indico Central - Events Organisation, Ergonomics and Collaboration Tools Integration . 7 Alternative Factory Model for Event Processing with Data on Demand .......... 8 Multi-threaded Event Reconstruction with JANA ...................... 8 A minimal xpath parser for accessing XML tags from C++ ................. 8 A Comparison of Data-Access Platforms for BaBar and ALICE analysis
    [Show full text]
  • Cherrypy Documentation Release 3.2.4
    CherryPy Documentation Release 3.2.4 CherryPy Team Jun 30, 2017 Contents 1 Foreword 1 1.1 Why CherryPy?.............................................1 1.2 Success Stories..............................................2 2 Installation 5 2.1 Requirements...............................................5 2.2 Supported python version........................................6 2.3 Installing.................................................6 2.4 Run it...................................................6 3 Tutorials 9 3.1 Tutorial 1: A basic web application................................... 10 3.2 Tutorial 2: Different URLs lead to different functions.......................... 10 3.3 Tutorial 3: My URLs have parameters.................................. 11 3.4 Tutorial 4: Submit this form....................................... 12 3.5 Tutorial 5: Track my end-user’s activity................................. 13 3.6 Tutorial 6: What about my javascripts, CSS and images?........................ 14 3.7 Tutorial 7: Give us a REST....................................... 15 3.8 Tutorial 8: Make it smoother with Ajax................................. 17 3.9 Tutorial 9: Data is all my life...................................... 19 3.10 Tutorial 10: Organize my code...................................... 22 4 Basics 23 4.1 The one-minute application example.................................. 24 4.2 Hosting one or more applications.................................... 25 4.3 Logging.................................................. 26 4.4 Configuring...............................................
    [Show full text]
  • Why We Use Django Rather Than Flask in Asset Management System
    9 VI June 2021 https://doi.org/10.22214/ijraset.2021.35756 International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.429 Volume 9 Issue VI Jun 2021- Available at www.ijraset.com Why we use Django rather than Flask in Asset Management System Anuj Kumar Sewani1, Chhavi Jain2, Chirag Palliwal3, Ekta Yadav4, Hemant Mittal5 1,2,3,4U.G. Students, B.Tech, 5Assistant Professor, Dept. of Computer Science & Engineering, Global Institute of Technology, Jaipur Abstract: Python provide number of frameworks for web development and other applications by Django, Flask, Bottle, Web2py, CherryPy and many more. Frameworks are efficient and versatile to build, test and optimize software. A web framework is a collection of package or module which allows us to develop web applications or services. It provides a foundation on which software developers can built a functional program for a specific platform. The main purpose of this study about python framework is to analyze which is better framework among Django or flask for web development. The study implement a practical approach on PyCharm. The result of this study is - “Django is better than flask”. I. INTRODUCTION Asset management refers to the process of developing, operating, maintaining, and selling assets in a cost-effective manner. Most commonly used in finance, the term is used in reference to individuals or firms that manage assets on behalf of individuals or other entities. Asset Management System are used to manage all the assets of a company, we can use this software to manage assets in any field i.e.
    [Show full text]
  • Rapid Web Development Using Python and AJAX
    Search for CMS data: rapid web development using python and AJAX Valentin Kuznetsov Cornell University Introduction LHC experiments set a new scale for data management DB MetaData Requirements: • Easy data access • Dynamic content and navigation • intelligent data query • integration with other applications CHEP 2007 Valentin Kuznetsov Choice Requirements • Fast turn around with changes, schema/tools evolution • Rapid web development • different views for data discovery (production, physicists, etc.) • Java too heavy, Ruby too new • Python is well adopted, used almost everywhere in CMS • easy to use, very flexible, tons of tools, ideal for prototyping • AJAX (Asynchronous JavaScript and XML) is a tool to provide dynamic web content CHEP 2007 Valentin Kuznetsov Tools ❖ Java Script toolkits: Stackable approach: ❖ Really Simple History (RSH) framework makes it easy for AJAX applications to model-view-controller incorporate bookmarking and back and architecture button support. ❖ Yahoo UI (YUI) as a cross-browser Controller JavaScript library ❖ OpenRICO as AJAX framework ❖ Cheetah for web page templates View Model ❖ CherryPy as a reach web server ❖ SQLAlchemy for transparent DB access (SQL abstraction layer/Object Relational Mapper) CHEP 2007 Valentin Kuznetsov Workflow http://cmsdbs.cern.ch/discovery/getData?dbsInst=MC Location # Events Block name Apache web JavaScripts web server More info services via AJAX Template toolkit Cheetah web application CherryPy Cheetah AJAX framework server CLI API External applications SQL toolkit and Object Relational
    [Show full text]
  • Business Uses for Python & IBM I
    Business uses for Python & IBM i Mike Pavlak – IT Strategist [email protected] A little background, please What is Python, really? ￭ General purpose language ￭ Easy to get started ￭ Simple syntax ￭ Great for integrations (glue between systems) ￭ Access to C and other APIs ￭ Infrastructure first, but applications, too 4 Historically… ￭ Python was conceptualized by Guido Van Rossum in the late 1980’s ￭ Rossum published the first version of Python code (0.9.0) in February of 1991 at the CWI(Centrum Wiskunde & Informatica) in the Netherlands, Amsterdam ￭ Python is derived from the ABC programming language, which is a general purpose language that was also developed at CWI. ￭ Rossum chose the name “Python” since he was a fan of Monty Python’s Flying Circus. ￭ Python is now maintained by a core development team at the institute, although Rossum still holds a vital role in directing its progress and as leading “commitor”. 5 Python lineage ￭ Python 1 – 1994 ￭ Python 2 – 2000 (Not dead yet…) ▶2,7 – 2010 ￭ Python 3 – 2008 ▶3.5 – 2015 ▶3.6.2 – July 2017 ▶3.7 ➔ ETA July 2018 6 Why use it? Academia ￭ 1970’s ▶COBOL, Basic ￭ 1980’s ▶Pascal, Delphi ￭ 1990’s ▶Java ￭ 2000 ▶Python & Open Source 8 Carnegie Mellon ￭ School discovered that students understood OO ▶But could not build a logic loop to save their soul! ￭ Robert Harper, professor of CS writes: “Object-oriented programming is eliminated entirely from the introductory curriculum, because it is both anti-modular and anti- parallel by its very nature, and hence unsuitable for a modern
    [Show full text]
  • Enterprise Web Framework This Document Is an Overview of New Features in 1.63
    web2py Enterprise Web Framework this document is an overview of new features in 1.63 Startup Interface Download and click! No Installation No Dependencies No Configuration Runs Everywhere including Google App Engine Web Based Admin Interface Login Manage Apps Create Apps Design Apps Test/Debug Mercurial Integration Web Based Admin Interface receive web2py announcements from twitter be notified of upgrades web2py Architecture Each app has its own database administrative interface welcome admin examples user app app app apps (scaffolding) gluon (session, request, response, cookies, security, template language, database abstraction layer, caching, errors, routes, upload/download streaming, internationalization, etc.) cherrypy wsgi web server handlers www mod_proxy cgi, fcgi, mod_python, mod_wsgi Web Based Admin Interface type “images” Web Based Admin Interface click to run The Scaffolding App click to go back The Scaffolding App App Authentication Custom Menu Quick Links The Scaffolding App click to EDIT Edit an App Metadata what is this app about? what is this license? Edit an App click to toggle Edit your Models click for database admin Models describe the “data representation” of you app db.py connects to DB, defines tables, Auth, Crud (edit this file to add tables) menu.py defines menus for the scaffoling app (can be removed if not needed) Edit your Controllers click to ajax shell or run doctests Controllers describe the workflow of your app default.py is the default (entry point) controller of your app appadmin.py defines a database administrative interface for your app (appadmin) click on [test] to run all doctests online Edit your Views adds ajax capabilities Each function in controller returns a dictionary that is rendered by a view file.
    [Show full text]