Python for the web: WSGI, ASGI and frameworks

Practice that adapts to you

Practise this lesson

14 questions about 6 ideas of this lesson. Each answer is explained at once, and what you get right is kept in this browser.

1. Question 1 of 14 What does a WSGI application return?

   Choose one answer.

   An iterable of bytes, after it has called start_response(status, headers) A dictionary with status, headers and body A coroutine that sends http.response events A string with the whole HTTP response

   Show the answer: Question 1 of 14

   Answer: An iterable of bytes, after it has called start_response(status, headers)

   PEP 3333 makes the application a callable of environ and start_response; it calls start_response with the status and a list of header pairs and returns an iterable that yields the body as bytes.

2. Question 2 of 14 A request asks for /hello?name=Asha. Where does a WSGI app find name=Asha?

   Choose one answer.

   In environ['PATH_INFO'] In the arguments of start_response() In environ['QUERY_STRING'] In scope["query_string"]

   Show the answer: Question 2 of 14

   Answer: In environ['QUERY_STRING']

   environ holds the request: the path in PATH_INFO, the query string in QUERY_STRING, the headers as HTTP_ keys and the body as a stream.

3. Question 3 of 14 An ASGI app receives an http.request event with more_body set to true. What should it do?

   Choose one answer.

   Ask the client to send the body again Raise an error, because a body must arrive in one event Keep calling receive() and joining the bodies until an event has more_body false Answer at once; the rest of the body is optional

   Show the answer: Question 3 of 14

   Answer: Keep calling receive() and joining the bodies until an event has more_body false

   The ASGI HTTP specification sends a request body in one or more http.request events; more_body true means more events follow, and the app joins their bodies in order.

4. Question 4 of 14 Which headers value is right for an http.response.start event, by the ASGI specification?

   Choose one answer.

   {'Content-Type': 'text/plain'} [("Content-Type", "text/plain")] [(b"content-type", b"text/plain; charset=utf-8")] "Content-Type: text/plain"

   Show the answer: Question 4 of 14

   Answer: [(b"content-type", b"text/plain; charset=utf-8")]

   An ASGI response's headers are pairs of bytes, and the specification requires header names to be lower-cased: [(b"content-type", b"text/plain; charset=utf-8")], as hello_both.py sends.

5. Question 5 of 14 What does word_count_app.py print?

   What does this program print? Choose one answer.

   """An ASGI app tested by calling it directly: a fake scope, a receive() that delivers the body in chunks, a send() that records."""
   import asyncio
   import json
   
   
   async def read_body(receive):
       """Collect the request body, which may arrive in several http.request events."""
       chunks = []
       while True:
           event = await receive()
           if event["type"] == "http.disconnect":
               raise ConnectionError("the client went away")
           chunks.append(event.get("body", b""))
           if not event.get("more_body", False):
               return b"".join(chunks)
   
   
   async def respond(send, status, data):
       body = json.dumps(data).encode()
       await send({"type": "http.response.start", "status": status,
                   "headers": [(b"content-type", b"application/json"), (b"content-length", str(len(body)).encode())]})
       await send({"type": "http.response.body", "body": body})
   
   
   async def app(scope, receive, send):
       if scope["type"] != "http":
           raise ValueError(f"unsupported protocol: {scope['type']}")
       if scope["path"] != "/count":
           return await respond(send, 404, {"error": "not found"})
       if scope["method"] != "POST":
           return await respond(send, 405, {"error": "use POST"})
       text = (await read_body(receive)).decode("utf-8")
       await respond(send, 200, {"words": len(text.split()), "characters": len(text)})
   
   
   async def call(app, method, path, chunks=(b"",)):
       """A test client in a dozen lines: what an ASGI server would do, without a socket."""
       scope = {"type": "http", "method": method, "path": path, "query_string": b"", "headers": []}
       events = [{"type": "http.request", "body": c, "more_body": i < len(chunks) - 1} for i, c in enumerate(chunks)]
       sent = []
   
       async def receive():
           return events.pop(0)
   
       async def send(message):
           sent.append(message)
   
       await app(scope, receive, send)
       start, body = sent[0], b"".join(m.get("body", b"") for m in sent[1:])
       return start["status"], json.loads(body)
   
   
   async def main():
       print(await call(app, "POST", "/count", [b"to be or ", b"not to ", b"be"]))  # three chunks
       print(await call(app, "GET", "/count"))
       print(await call(app, "POST", "/other"))
       try:
           await app({"type": "lifespan"}, None, None)
       except ValueError as error:
           print("lifespan:", error)
   
   
   asyncio.run(main())

   (200, {'words': 6, 'characters': 18}) (405, {'error': 'use POST'}) (404, {'error': 'not found'}) lifespan: unsupported protocol: lifespan (200, {'words': 6, 'characters': 18}) (200, {'words': 0, 'characters': 0}) (404, {'error': 'not found'}) lifespan: unsupported protocol: lifespan (200, {'words': 2, 'characters': 9}) (405, {'error': 'use POST'}) (404, {'error': 'not found'}) lifespan: unsupported protocol: lifespan

   Show the answer: Question 5 of 14

   Answer: it prints

   (200, {'words': 6, 'characters': 18})
   (405, {'error': 'use POST'})
   (404, {'error': 'not found'})
   lifespan: unsupported protocol: lifespan

   The test client delivers the body in three chunks and the app joins all of them before counting, so it sees the whole sentence. GET on /count is refused with 405, /other does not exist, and the lifespan scope is rejected with ValueError, as the ASGI specification asks for protocols an app does not support.

6. Question 6 of 14 Why can a test call an ASGI app without starting a server?

   Choose one answer.

   The app is just an async function of scope, receive and send, so the test can pass its own ASGI apps do not need receive() or send() in tests Only frameworks can be tested without a server, not plain apps Tests run the server in the background automatically

   Show the answer: Question 6 of 14

   Answer: The app is just an async function of scope, receive and send, so the test can pass its own

   Both interfaces are function calls. A test that builds a scope, a receive() and a send() is exactly what a server would do, without the network; framework test clients work on the same principle.

7. Question 7 of 14 You add a test for an http.disconnect event that arrives before the body is complete. What should word_count_app.py's read_body() do, and how does the test check it?

   Choose one answer.

   Wait for the rest of the body; the test cannot check it Raise ConnectionError; the test hands out a disconnect event and expects the error Nothing; disconnects only happen with real sockets Count the words received so far; the test checks the partial count

   Show the answer: Question 7 of 14

   Answer: Raise ConnectionError; the test hands out a disconnect event and expects the error

   A fake receive() can hand out any event the specification defines, including http.disconnect, so tests can cover what a real network does only now and then.

8. Question 8 of 14 Which statements about async frameworks are true?

   Choose every answer that is right.

   Async makes CPU-heavy work, such as resizing images, finish faster One blocking call, such as time.sleep() or a sync database driver, stalls every request on that event loop Async views under a WSGI server keep their full benefits Async helps when requests spend their time waiting for databases, other APIs or slow clients

   Show the answer: Question 8 of 14

   Answer:

   • One blocking call, such as time.sleep() or a sync database driver, stalls every request on that event loop
   • Async helps when requests spend their time waiting for databases, other APIs or slow clients

   Async overlaps waits, as the one-worker example showed; it does not make computation faster. A blocking call inside an async view holds up the loop for every other request. Under WSGI, Django and Flask run async views in an event loop per request: a view can still overlap its own calls, but every request holds a worker, as it does with sync views.

9. Question 9 of 14 In one_worker.py, why did the async worker serve three 0.2 s waits in about 0.2 s?

   Choose one answer.

   asyncio.sleep() sleeps for a shorter time than time.sleep() Each await asyncio.sleep() handed the event loop back, so the three waits overlapped asyncio ran the three requests on three processors The async version skipped two of the requests

   Show the answer: Question 9 of 14

   Answer: Each await asyncio.sleep() handed the event loop back, so the three waits overlapped

   A blocking sleep holds the worker, so three waits take 0.6 s in a row. An await gives the loop back, so the three waits overlap and take about one wait.

10. Question 10 of 14 Which framework builds JSON APIs on ASGI from the type hints of your functions?

    Choose one answer.

    Werkzeug Django Flask FastAPI

    Show the answer: Question 10 of 14

    Answer: FastAPI

    FastAPI describes itself as a framework for building APIs from standard Python type hints, built on Starlette for the web parts and Pydantic for the data parts.

11. Question 11 of 14 A Flask site must add a live feed that keeps a WebSocket open to each of 2,000 visitors. What does the lesson's comparison suggest?

    Choose one answer.

    Add Django's admin site Turn every Flask view into async def, which gives Flask WebSockets Run more Flask development servers Serve the feed from an ASGI stack, such as Quart or FastAPI, because Flask has no WebSockets and ties up a worker per request

    Show the answer: Question 11 of 14

    Answer: Serve the feed from an ASGI stack, such as Quart or FastAPI, because Flask has no WebSockets and ties up a worker per request

    WebSockets and connections that stay open need ASGI. Flask's own project offers Quart for an async-first, Flask-style app, and FastAPI has WebSockets built in through Starlette.

12. Question 12 of 14 What should serve a Flask app in production?

    Choose one answer.

    The development server started with flask run The debug page, so errors show in the browser A production WSGI server, such as Gunicorn Uvicorn, because Flask is an ASGI app

    Show the answer: Question 12 of 14

    Answer: A production WSGI server, such as Gunicorn

    Development servers are for development. A Flask app in production runs on a WSGI server such as Gunicorn, and ASGI apps on servers such as Uvicorn.

13. Question 13 of 14 What does Django do about CSRF when you create a project?

    Choose one answer.

    It encrypts the session cookie, which prevents CSRF Its CSRF middleware is on by default, and forms carry the token with the csrf_token tag It blocks every POST request Nothing; CSRF protection needs an extension

    Show the answer: Question 13 of 14

    Answer: Its CSRF middleware is on by default, and forms carry the token with the csrf_token tag

    Django's CsrfViewMiddleware is active by default. Templates put {% csrf_token %} inside each POST form, and a request without a valid token is answered with 403 Forbidden.

14. Question 14 of 14 A Django form on your own site fails with 403 Forbidden after a template change. What is the right fix?

    Choose one answer.

    Change the form to GET Put the csrf_token tag back inside the form Remove the CSRF middleware from the settings Mark the view csrf_exempt

    Show the answer: Question 14 of 14

    Answer: Put the csrf_token tag back inside the form

    The 403 means the check worked: the form did not carry a token. Send the token, never turn the check off to make a form work.