Cookie, sessiya va holat

import socket
import threading

PORT = 9800

tinglovchi = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
tinglovchi.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
tinglovchi.bind(("127.0.0.1", PORT))
tinglovchi.listen(4)

# Server tomonidagi sessiya ombori
SESSIYALAR = {"s-abc123": {"ism": "Husanboy", "korishlar": 0}}


def sarlavha_top(sorov, nom):
    for q in sorov.split("\r\n")[1:]:
        if q.lower().startswith(nom.lower() + ":"):
            return q.split(":", 1)[1].strip()
    return None


def server(nechta):
    for _ in range(nechta):
        ulanish, _ = tinglovchi.accept()
        sorov = ulanish.recv(4096).decode()
        cookie = sarlavha_top(sorov, "Cookie")

        qoshimcha = ""
        if cookie and "sessiya=" in cookie:
            sid = cookie.split("sessiya=")[1].split(";")[0]
            sessiya = SESSIYALAR.get(sid)
            if sessiya:
                sessiya["korishlar"] += 1
                tana = (f"Xush kelibsiz, {sessiya['ism']}! "
                        f"Ko'rishlar: {sessiya['korishlar']}")
            else:
                tana = "Sessiya topilmadi"
        else:
            tana = "Salom, mehmon! Sizga sessiya berildi."
            qoshimcha = ("Set-Cookie: sessiya=s-abc123; Path=/; "
                         "HttpOnly; SameSite=Lax\r\n")

        yuk = tana.encode()
        javob = (f"HTTP/1.1 200 OK\r\n{qoshimcha}"
                 f"Content-Length: {len(yuk)}\r\n"
                 f"Connection: close\r\n\r\n").encode() + yuk
        ulanish.sendall(javob)
        ulanish.close()


oqim = threading.Thread(target=server, args=(3,), daemon=True)
oqim.start()


def sorov_yubor(cookie=None):
    m = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    m.settimeout(5)
    m.connect(("127.0.0.1", PORT))
    satr = "GET / HTTP/1.1\r\nHost: x\r\n"
    if cookie:
        satr += f"Cookie: {cookie}\r\n"
    m.sendall((satr + "\r\n").encode())
    javob = b""
    while True:
        b = m.recv(1024)
        if not b:
            break
        javob += b
    m.close()
    sarlavhalar, tana = javob.decode().split("\r\n\r\n", 1)
    return sarlavhalar, tana


print("1-tashrif (cookie yo'q):")
s, t = sorov_yubor()
for q in s.split("\r\n"):
    if q.startswith("Set-Cookie"):
        print("  server berdi ->", q)
print("  tana:", t)

print()
print("2-tashrif (brauzer cookie ni qaytaradi):")
s, t = sorov_yubor("sessiya=s-abc123")
print("  tana:", t)

print()
print("3-tashrif:")
s, t = sorov_yubor("sessiya=s-abc123")
print("  tana:", t)

oqim.join()
tinglovchi.close()

COOKIELAR = [
    "sessiya=s-abc123; Path=/; HttpOnly; Secure; SameSite=Strict",
    "mavzu=qorong; Path=/; Max-Age=31536000",
    "kuzatuv=xyz; Domain=.reklama.example; SameSite=None; Secure",
]

IZOHLAR = {
    "httponly": "JavaScript o'qiy olmaydi",
    "secure": "faqat HTTPS orqali",
    "samesite": "begona saytdan kelganda cheklanadi",
    "max-age": "necha soniya saqlanadi",
    "path": "qaysi yo'llarda yuboriladi",
    "domain": "qaysi domenlarga yuboriladi",
}

for matn in COOKIELAR:
    bolaklar = [b.strip() for b in matn.split(";")]
    nom, qiymat = bolaklar[0].split("=", 1)
    print(f"{nom} = {qiymat}")
    for b in bolaklar[1:]:
        kalit = b.split("=")[0]
        qiy = b.split("=", 1)[1] if "=" in b else "-"
        print(f"   {kalit:<9} {qiy:<10} {IZOHLAR.get(kalit.lower(), '')}")
    print()

print("xavfsizlik uchun eng muhim uchtasi:")
for k in ["httponly", "secure", "samesite"]:
    print(f"  {k:<9} {IZOHLAR[k]}")

import hashlib
import hmac

MAXFIY = b"server-kaliti-hech-kimga-aytilmaydi"


def imzola(malumot):
    imzo = hmac.new(MAXFIY, malumot.encode(), hashlib.sha256).hexdigest()
    return f"{malumot}.{imzo[:16]}"


def tekshir(cookie):
    if "." not in cookie:
        return None
    malumot, imzo = cookie.rsplit(".", 1)
    kutilgan = hmac.new(MAXFIY, malumot.encode(),
                        hashlib.sha256).hexdigest()[:16]
    # hmac.compare_digest - vaqt bo'yicha xavfsiz taqqoslash
    if hmac.compare_digest(imzo, kutilgan):
        return malumot
    return None


toza = imzola("foydalanuvchi=husanboy&rol=oquvchi")
print("server bergan cookie:")
print("  ", toza)

print()
print("tekshiruv:", tekshir(toza))

# Endi kimdir qiymatni o'zgartirmoqchi bo'ladi
buzilgan = toza.replace("rol=oquvchi", "rol=admin")
print()
print("o'zgartirilgan cookie:")
print("  ", buzilgan)
print("tekshiruv:", tekshir(buzilgan))

print()
print("imzo mos kelmadi, chunki maxfiy kalit faqat serverda")
print("qiymat KO'RINADI, lekin uni O'ZGARTIRIB bo'lmaydi")