cyber-students

This repository provides some sample code for the Shared Project for Modern Cryptography and Security Management & Compliance. The project requires git, Python 3, and MongoDB. The following sections briefly explain how to setup the project on your local machine.

Get the Sample Code

Create a GitHub account. Download and install git. We will use git to manage our source code.

Verify that git is installed correctly:

git --version

Fork this repository and clone your forked repository to your local machine:

git clone https://github.com/YOUR_GITHUB_USERNAME/cyber-students.git

Setup the Project

Create a Python 3 virtual environment:

python -m venv project-venv

Activate the virtual environment:

:: ... on Windows:
.\project-venv\Scripts\activate

# ... on macOS/*nix:
source project-venv/bin/activate

Install the required packages:

cd cyber-students
pip install -r requirements.txt

Download, install and start MongoDB Community Edition. We will use MongoDB as our database.

Download and install MongoDB Shell. Open a MongoDB shell:

mongosh

Create a database with a collection named users:

use cyberStudents;
db.createCollection('users');

This database will store our data. The tests use an in-memory mock database, so they do not require a running MongoDB server.

Download and install curl. curl is also shipped by Microsoft as part of Windows 10 and 11. curl is a command-line tool for interacting with web servers (and other protocols).

Verify that curl is installed correctly:

curl --version

Start the Project

The server contains functionality for:

• registering new users (api/handlers/registration.py)
• logging in (api/handlers/login.py)
• logging out (api/handlers/logout.py)
• displaying profile (api/handlers/user.py)

To start the server:

python run_server.py

The server is available on port 4000 at http://localhost:4000/students/api. However, it is not possible to use all of the functionality offered by the server directly using a browser. Instead we will use curl to interact with the server.

Registration

To register a new user:

curl -X POST http://localhost:4000/students/api/registration -d "{\"email\": \"foo@bar.com\", \"password\": \"pass\", \"displayName\": \"Foo Bar\"}"

If the registration is successful, it will confirm the email address and the display name of the newly registered user:

{"email": "foo@bar.com", "displayName": "Foo Bar"}

If the registration is unsuccessful, for example, if you try to register the same user twice, it will return an error message:

{"message": "A user with the given email address already exists!"}

Logging In

To login:

curl -X POST http://localhost:4000/students/api/login -d "{\"email\": \"foo@bar.com\", \"password\": \"pass\"}"

If the login is successful, it will return a token and expiration timestamp:

{"token": "d4a5d8b20fe143b7b92e4fba92d409be", "expiresIn": 1648559677.0}

A token expires and is intended to be short-lived. A token expires two hours after login, after a logout, or if there is another login from the same user, generating a new token.

If the login is unsuccessful, for example, if you provide an incorrect password, it will return an error message:

{"message": "The email address and password are invalid!"}

Displaying a Profile

To display a user's profile you need a token that has not expired. Then you can use:

curl -H "X-Token: d4a5d8b20fe143b7b92e4fba92d409be" http://localhost:4000/students/api/user

Note that this API call does not require the -X POST flag.

If successful, it will return the email address and the display name for the user:

{"email": "foo@bar.com", "displayName": "Foo Bar"}

Logging Out

To logout, you also need a token that has not expired. Then you can use:

curl -X POST -H "X-Token: d4a5d8b20fe143b7b92e4fba92d409be" http://localhost:4000/students/api/logout

Test the Project

You can run the automated tests using:

python run_test.py

This command runs a number of automated tests in the test directory. The tests use an in-memory mock database and perform tests such as registering new users (test/registration.py), logging in (test/login.py), and logging out (test/logout.py).

The project also includes a program called run_hacker.py. You can run it using:

python run_hacker.py list

It displays all information stored in the MongoDB database. It produces output similar to the following:

There are 1 registered users:
{'_id': ObjectId('6242d9c34536b3a16b49aa6b'), 'email': 'foo@bar.com', 'password': 'pass', 'displayName': 'Foo Bar'}

As you can see, all of the information is stored in the clear; there is no encryption or password hashing. If a hacker was to compromise the database, they could easily run a similar program to retrieve all of the users personal information and passwords.