1. Web Server Design Assignment #5: Unsafe Methods & CGI
Old Dominion University
Department of Computer Science
CS 495/595 Spring 2007
Michael L. Nelson

2. Grading
To be done by an automated program that will test most (all?) combinations
assignment is listed under the day it is to be demoed in class
each group will give a 3-4 minute status report the week before an assignment is due!
If you have a question:
the class list
mimic the behavior of a well known Apache server (e.g.,

3. Methods to Support Same as assignments 1-4, plus: DELETE, PUT, POST
as per Lecture 14
n.b. OPTIONS (lecture 14)

4. Status Codes to Support
Same as assignments 1-4, plus:
201 Created
PUT, POST
405 Method Not Allowed
411 Length Required
413 Request Entity Too Large
414 Request-URI Too Long

5. Request Headers Same as assignments 1-4, plus: Content-type:
Content-Length:
Content-Disposition: (in form data)

6. Response Headers
Same as assignments 1-4

7. MIME Types, Encodings, etc.
All as per assignments 1-4, plus:
Your server accepts the following “Content-Type” headers:
multipart/form-data
application/x-form-www-urlencoded

8. Guidelines
PUT, DELETE are allowed recursively, as per directives in the WeMustProtectThisHouse! file
Limits
URI: 2k
Entity: 2MB
You should flag for Entities longer than advertised as per the “Content-Length” header, but I will not test for error conditions
Always issue an HTML description describing the results (success or failure) of PUT and DELETE
we will not produce 202 or 204

9. WeMustProtectThisHouse! Format
% cat WeMustProtectThisHouse\! #
ALLOW-PUT
ALLOW-DELETE
authorization-type=Basic
realm=“Lane Stadium”
# always quote realm since it might have spaces
# user format = name:md5(password)
mln:d3b07384d113edec49eaa6238ad5ff00
bda:c157a79031e1c40f bc5fc552
jbollen:66e0459d0abbc8cd8bd9a88cd226a9b2

10. CGI Invocation Invoke the URI as an executable program iff: Warning!!!
POST method
GET method with “query string”
Warning!!!
ensure your URI is relative to your document root
dangerous: GET /bin/rm?-rf HTTP/1.1

11. CGI Program #!/usr/bin/perl print "Content-type: text/html\n\n";
foreach $key (keys (%ENV)) {
print "$key = $ENV{$key} <br>\n"; }
while (<STDIN>) {
print "$_<br>\n";

12. Required Environment Variables
SCRIPT_NAME
SCRIPT_URI
SCRIPT_FILENAME
HTTP_REFERER
HTTP_USER_AGENT
REQUEST_METHOD
REMOTE_ADDR
QUERY_STRING
REMOTE_USER
AUTH_TYPE
SERVER_NAME
SERVER_SOFTWARE
SERVER_PORT
SERVER_ADDR
SERVER_PROTOCOL
leave blank if
not available