MIT GSL 2018 week 1 | day 4 Introduction to Web Development II

Any HTML or JavaScript Questions?

Server - Client Relationship https://cybersecuritynews.co.uk

HTTP Requests Hypertext Transfer Protocol Methods GET POST PUT HEAD DELETE PATCH OPTIONS

HTTP Requests GET is used to request data from a specified resource POST is used to send data to a server to create/update a resource PUT is used to send data to a server to create/update a resource The difference between POST and PUT is that PUT requests are idempotent. That is, calling the same PUT request multiple times will always produce the same result. In contrast, calling a POST request repeatedly have side effects of creating the same resource multiple times.

GET POST BACK button/Reload Harmless Data will be re-submitted (the browser should alert the user that the data are about to be re-submitted) Bookmarked Can be bookmarked Cannot be bookmarked Cached Can be cached Not cached Encoding Type application/x-www-form-urlencoded application/x-www-form-urlencoded or multipart/form-data. Use multipart encoding for binary data History Parameters remain in browser history Parameters are not saved in browser history Restrictions on data length Yes, when sending data, the GET method adds the data to the URL; and the length of a URL is limited (maximum URL length is 2048 characters) No restrictions Restrictions on data type Only ASCII characters allowed No restrictions. Binary data is also allowed Security GET is less secure compared to POST because data sent is part of the URL Never use GET when sending passwords or other sensitive information! POST is a little safer than GET because the parameters are not stored in browser history or in web server logs Visibility Data is visible to everyone in the URL Data is not displayed in the URL

AJAX AJAX = Asynchronous JavaScript And XML. Not a programming language, but instead a method for getting servers from a web page. The whole point is that it’s possible to update parts of a web page, without having to reload the entire page. This is made possible because of the XMLHttpRequest Object.

AJAX

AJAX To send the request, use the open and send properties, then your request can either be a get or post.

AJAX For more information on the properties and methods you can use with AJAX, go to https://www.w3schools.com/xml/ajax_applications.asp A good example - https://www.w3schools.com/jquery/jquery_ajax_load.asp

Model-View-Controller(MVC) Model: Structures your data in a reliable form and prepares it based on controller’s instructions View: Displays data to user in easy-to-understand format, based on the user’s actions Controller: Takes in user commands, sends commands to the model for data updates, sends instructions to view to update interface.

Model-View-Controller(MVC)

Model-View-Controller(MVC) The user makes a request along a route, let’s say /home The controller receives this request and gives a specific set of orders that are related to that route. These instructions could either be for the view to update or serve a certain page, or for the model to perform specific logic. Let’s assume this request has some logic associated with it. The model carries out the logic, pulls from a database and sends back a consistent response based on the controller’s instructions. The controller then passes this data to the view to update the user interface.

Cyber Security Two types of attacks: Passive and Active Recent famous hacks: Sony (credit card), US Senate (files), and Epsilon (customers)

Cyber Security What is malware: “Malware is malicious software or code that typically dam-ages or disables, takes control of, or steals information from a computer system. Malware broadly includes botnets, viruses, worms, Trojan horses, logic bombs, rootkits, bootkits, back- doors, spyware, and adware. “ Spear phishing-- when you try and seem more credible to get more personal information out of users.

Cyber Security Here is the life cycle of an Attack: Infection (target system), Persistence (preservation and privileged access), Communication (hiding your actions), Command & Control (manageable) bypass normal authentication Exploit target, deliver malware

Lab Exercises

Wrap-Up Review of Lecture Overview of Next Steps Questions