Request Method POST w JSON

Using Request Method POST in combination with SSL makes datatransfer more secure.

In addition…

Most of the encoding and decoding is not needed any more
The URL will be visible to any one and needs to be url encoded. The data will be send separately and therefor should be secured via SSL
The size of the data is almost unlitmited
Still needs protection against Cross-Side-Scripting (XSS)

To keep this showcase simple we want to receive JSON Dataand communication should be over Cross-Origin Resource Sharing (CORS). The following script will also demonstrate two different Content-Types.

#!/bin/bash

exec 2>/dev/null    # We dont want any error messages be printed to stdout
trap "response_with_html && exit 0" ERR    # response with an html message when an error occurred and close the script

function response_with_html(){    
    echo "Content-type: text/html"
    echo ""
    echo "<!DOCTYPE html>"
    echo "<html><head>"
    echo "<title>456</title>"
    echo "</head><body>"
    echo "<h1>456</h1>"
    echo "<p>Attempt to communicate with the server went wrong.</p>"
    echo "<hr>"
    echo "$SERVER_SIGNATURE"
    echo "</body></html>"
}
        
function response_with_json(){
    echo "Content-type: application/json"
    echo ""
    echo "{\\"message\\": \\"Hello World!\\"}"
}

if [ "$REQUEST_METHOD" = "POST" ]; then
   
    # The environment variabe $CONTENT_TYPE describes the data-type received
    case "$CONTENT_TYPE" in
    application/json)
        # The environment variabe $CONTENT_LENGTH describes the size of the data
        read -n "$CONTENT_LENGTH" QUERY_STRING_POST        # read datastream 

        # The following lines will prevent XSS and check for valide JSON-Data.
        # But these Symbols need to be encoded somehow before sending to this script
        QUERY_STRING_POST=$(echo "$QUERY_STRING_POST" | sed "s/'//g" | sed 's/\\$//g;s/`//g;s/\\*//g;s/\\\\//g' )        # removes some symbols (like \\ * ` $ ') to prevent XSS with Bash and SQL.
        QUERY_STRING_POST=$(echo "$QUERY_STRING_POST" | sed -e :a -e 's/<[^>]*>//g;/</N;//ba')    # removes most html declarations to prevent XSS within documents
        JSON=$(echo "$QUERY_STRING_POST" | jq .)        # json encode - This is a pretty save way to check for valide json code
    ;;
    *)
        response_with_html
        exit 0
    ;;
    esac

else
    response_with_html
    exit 0
fi

# Some Commands ...

response_with_json

exit 0

You will get {"message":"Hello World!"} as an answer when sending JSON-Data via POST to this Script. Every thing else will receive the html document.

Important is also the varialbe $JSON. This variable is free of XSS, but still could have wrong values in it and needs to be verify first. Please keep that in mind.

This code works similar without JSON. You could get any data this way. You just need to change the Content-Type for your needs.

Example:

if [ "$REQUEST_METHOD" = "POST" ]; then 
    case "$CONTENT_TYPE" in
    application/x-www-form-urlencoded)
            read -n "$CONTENT_LENGTH" QUERY_STRING_POST
    text/plain)
            read -n "$CONTENT_LENGTH" QUERY_STRING_POST
    ;;
    esac
fi

Last but not least, dont forget to response to all requests, otherwise third party programms wont know if they succeeded