webserver implementation

[storchalberto]

I am using berry language to publish my pages using the webserver interface. To allow the possibility for the berry code to use the standard methodology of authentication in the browser, it is possible to implement a function that request the webserver to send back the http code "401 Unauthorized" to force the remote browser to request username and password and then retreive the Authorization code from new request in the header (probably the .header allow this)?

[sfromis]

It seems to have been missed in the docs, but among the "low level" functions in the webserver module, there's also a content_open method with arguments http code and mimetype.

BTW, there's also an "unmentioned" redirect method taking a string as argument, for the "Location" header, and setting http status 302.

[sfromis]

Both methods have now been added to the Tasmota/Berry docs page

[storchalberto]

here my code for testing:

import webserver
class Web_page_demo : Driver
def page_say_hello()
if !webserver.check_privileged_access() return nil end
var myauth=webserver.header("Authorization")
print(myauth)
var mybuff
if myauth!=nil
webserver.content_start("Hello page")
webserver.content_send_style()
webserver.content_send("Tasmota says hello!")
else
webserver.content_start("No Login")
webserver.content_open(401,"text/plain")
webserver.content_send("Tasmota says no login!")
webserver.content_send_style()
end
webserver.content_send(mybuff)
webserver.content_stop()
end
def web_add_handler()
webserver.on("/hello", / -> self.page_say_hello())
print("page added")
end
end
web_page_demo_instance = Web_page_demo()
tasmota.add_driver(web_page_demo_instance)
web_page_demo_instance.web_add_handler()

and i see the log:
09:14:45.004 stack traceback:
09:14:45.006 : in native function
09:14:45.008 : in function page_say_hello
09:14:45.010 : in function <lambda>
09:14:45.012 BRY: stack[1] = type='function' ()
09:14:45.014 BRY: stack[2] = type='string' (type_error)
09:14:45.016 BRY: stack[3] = type='nil' ()

[s-hadinger]

Have you set a password on the Tasmota web interface ?

if !webserver.check_privileged_access() refers to the internal Tasmota password scheme. I understand you want your own, different from Tasmota ?

[sfromis]

Also, you are probably not following the required protocol for 401.

[storchalberto]

Yes, i want to use authentication only on my own pages so i have not set a password for the web interface.
If i remove the statement if !webserver.check_privileged_access() i heve the same log, but in the page is displayed:
File Not Found

URI: /hello
Method: GET
Arguments: 0

[storchalberto]

For the respect of the protocol, the browser respect the standard protocol for authentication:

1. the browse request a page to the server.
2. The server test if in the header is present the authentication field and if the value is correct.
3. If not the server send back to the browser an http answer with code 401.
4. The brovser start a popup window with the request and password, when entered, resent to the web server the same get, with the field autentication populated.
   using the berry code indicated, my browser never popup the user-password request.

[sfromis]

It looks like following the protocol is more than just setting http status 401, but also setting the `WWW-Authenticate" header, which is not among the ones available.

Www-Authenticate: Basic realm="Login Required"

[storchalberto]

another problem. if i not insert the call to webserver.content_send_style() the page is not correct: the server send a page without the absent. Here the two page of the test, this with the webserver.content_send_style() present

<title>Tasmota - No Login</title><script>var x=null,lt,to,tp,pc='';eb=s=>document.getElementById(s);qs=s=>document.querySelector(s);sp=i=>eb(i).type=(eb(i).type==='text'?'password':'text');wl=f=>window.addEventListener('load',f);function jd(){var t=0,i=document.querySelectorAll('input,button,textarea,select');while(i.length>=t){if(i[t]){i[t]['name']=(i[t].hasAttribute('id')&&(!i[t].hasAttribute('name')))?i[t]['id']:i[t]['name'];}t++;}}function sf(s){var t=0,i=document.querySelectorAll('.hf');while(i.length>=t){if(i[t]){i[t].style.display=s?'block':'none';}t++;}}wl(jd);function su(t){eb('f3').style.display='none';eb('f2').style.display='block';t.form.submit();}function upl(t){var sl=t.form['u2'].files[0].slice(0,1);var rd=new FileReader();rd.onload=()=>{var bb=new Uint8Array(rd.result);if(bb.length==1&&bb[0]==0xE9){fct(t);}else{t.form.submit();};};rd.readAsArrayBuffer(sl);return false;};function fct(t){var x=new XMLHttpRequest();x.open('GET','/u4?u4=fct&api=',true);x.onreadystatechange=()=>{if(x.readyState==4&&x.status==200){var s=x.responseText;if(s=='false')setTimeout(()=>{fct(t);},6000);if(s=='true')su(t);}else if(x.readyState==4&&x.status==0){setTimeout(()=>{fct(t);},2000);};};x.send();}</script><style>div,fieldset,input,select{padding:5px;font-size:1em;}fieldset{background:#4f4f4f;}p{margin:0.5em 0;}input{width:100%;box-sizing:border-box;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;background:#dddddd;color:#000000;}input[type=checkbox],input[type=radio]{width:1em;margin-right:6px;vertical-align:-1px;}input[type=range]{width:99%;}select{width:100%;background:#dddddd;color:#000000;}textarea{resize:vertical;width:98%;height:318px;padding:5px;overflow:auto;background:#1f1f1f;color:#65c115;}body{text-align:center;font-family:verdana,sans-serif;background:#252525;}td{padding:0px;}button{border:0;border-radius:0.3rem;background:#1fa3ec;color:#faffff;line-height:2.4rem;font-size:1.2rem;width:100%;-webkit-transition-duration:0.4s;transition-duration:0.4s;cursor:pointer;}button:hover{background:#0e70a4;}.bred{background:#d43535;}.bred:hover{background:#931f1f;}.bgrn{background:#47c266;}.bgrn:hover{background:#5aaf6f;}a{color:#1fa3ec;text-decoration:none;}.p{float:left;text-align:left;}.q{float:right;text-align:right;}.r{border-radius:0.3em;padding:2px;margin:6px 2px;}.hf{display:none;}</style>

To use Tasmota, please enable JavaScript

ESP32-DevKit

Tasmota

Tasmota says no login!

---

Tasmota 13.4.0(ESP32_CENTRALE_ALLARME TEST) by Theo Arends

--
and this with the webserver.content_send_style() not present:

<title>Tasmota - No Login</title><script>var x=null,lt,to,tp,pc='';eb=s=>document.getElementById(s);qs=s=>document.querySelector(s);sp=i=>eb(i).type=(eb(i).type==='text'?'password':'text');wl=f=>window.addEventListener('load',f);Tasmota says no login!

---

Tasmota 13.4.0(ESP32_CENTRALE_ALLARME TEST) by Theo Arends

[storchalberto]

I have usad that to test the webserver.content_open and webserver.content_response functionality:
So i have modifyed the file to send in a pure text file.
Here the code i have used:
import webserver
import webserver
class Web_page_demo : Driver
def page_say_testtext()
if !webserver.check_privileged_access() return nil end
var fr=open("pagetext.txt", 'r')
var mybuff=fr.read()
fr.close()
webserver.content_open(200,"text/plain")

#webserver.content_response(mybuff) 
webserver.content_send(mybuff)

webserver.content_stop()                        

end
def web_add_handler()
webserver.on("/testtext", / -> self.page_say_testtext())
print("page added")
end
end
web_page_demo_instance = Web_page_demo()
tasmota.add_driver(web_page_demo_instance)
#web_page_demo_instance.web_add_handler()
and it do not function (i see a blanck page on the browser.
If i change the 2 lines:
#webserver.content_response(mybuff)
webserver.content_send(mybuff)
it function

[sfromis]

Yeah, do not use content_send or content_stop unless you are building a page within the Tasmota page structure. If you want a single file without wrapping, content_response is the right way, and this is meant to be the only method needed to serve a full page.

When already having a string, this works for me:

  def web_add_handler()
    import webserver
    webserver.on("/testing", / -> self.request())
  end

  def request()
    import webserver
    if !webserver.check_privileged_access() return nil end
    var response='testing'
    webserver.content_response(response)
  end

[storchalberto]

OK I want to test the webserver.content_open. This is my code :

  def web_add_handler()
    import webserver
    webserver.on("/testing", / -> self.request())
  end

  def request()
    import webserver
    if !webserver.check_privileged_access() return nil end
    webserver.content_open(200,"text/plain")
    var response='testing'
    webserver.content_response(response)
  end

that do not function

[s-hadinger]

Please use triple backticks '```' when quoting code, it makes it far easier to read

[storchalberto]

I have done a full testing for the use of the content_send() here the result:
1 webserver.content_open do not function,
2 the webserver.content_stop is mandatory,and it introduce the copyright. if you do not define the style (content_send_style)is a problem
3. if you do not use the content_send_style, the page MUST begin with the string </style>
4. if you use content_send_style do not start the page with </style> unless you will have 2 string in the page