Objective & prerequisites
Explain two different web boundaries using local examples. Prerequisites: basic Python expressions and files; use a disposable local practice folder and fictional data. This shared workshop complements the existing data/AI tracks and does not create a second progress system.
Understand the concept
CSRF protection checks that a state-changing request carries the expected session-bound token. Output escaping ensures entered text remains text in its destination context. Neither substitutes for active-user authorization. HTML escaping does not validate a URL scheme, and SQL parameterization does not prevent unsafe HTML output. Each boundary needs its own rule.
Worked example
The lab compares two fictional tokens with hmac.compare_digest and refuses a mismatch. html.escape turns a script-shaped string into literal text. No browser attack or network request is performed; the exercise demonstrates defensive transformations only.
python3 foundation_labs.py FoundationTests.test_csrf_and_outputTry it yourself
Run the test and explain why a valid CSRF token does not letuser 2 read user 1’s record. Identify where URL allowlisting would be needed in a document link. Record your prediction before running the supplied reference, then compare the observed result and explain any difference.
Worked solution
A token supports request authenticity for a session, not resource ownership. HTML attribute escaping and anhttp(s) URL allowlist are separate requirements for a link. Keep renderer templates trusted and never accept user-supplied executable markup or styles.
Knowledge check
Can HTML escaping replace authorization? Try answering without rereading the example.
Check and explain
No. It protects a rendering context, not permission to read or modify a record.
Mini-project, mistakes & handover
Produce a short README with the question, exact local command, input meaning, checks and actual results. Include one failure case and its explanation. Never silently turn an exception into a passing result. Mark simulated behavior explicitly, credit the supplied teaching code and identify your own contribution. These activities are unsaved self-practice, not certification.
Authoritative reference
— consulted for the underlying interface/concept. The lesson and fictional examples are original teaching material. Python reference tested with 3.12; designed for 3.10+. Git lab requires Git 2.28+.
Try the activity before reading its reference. Keep your sources, commands and assumptions with your work. Companion activities are unsaved self-practice and do not award a certificate or change lesson progress.