I'm currently implementing a CSS3 accordion effect and I am concerned about potential security risks. Specifically, I want to prevent hackers from creating a script for parallel requests. For example, on my page I have both a login form and a registration form, but only one is visible at a time due to CSS3 rules that require the user agent to be HTML5 compatible. To address this, I am using the following technique:
class Register(tornado.web.RequestHandler):
def post(self):
tt = self.get_argument("_xsrf") + str(time.time())
rtime = float(tt.replace(self.get_argument("_xsrf"), ""))
print rtime
class LoginHandler(BaseHandler):
def post(self):
tt = self.get_argument("_xsrf") + str(time.time())
ltime = float(tt.replace(self.get_argument("_xsrf"), ""))
print ltime
I have utilized the _xsrf variable with unique values for each user in order to prevent the server from being tricked into thinking multiple requests are coming from the same machine. Now, my aim is to differentiate between the time values: abs(ltime - rtime). How can I access rtime outside of the class? I know how to retrieve the value outside of the method, but I need to perform this operation to identify if the value is small, indicating a potential scripted attack aiming to overload the server.
To illustrate with a simpler Python example:
class Product:
def info(self):
self.price = 1000
def show(self):
print self.price
car = Product()
car.info()
car.show()
Output: 1000
However, if I introduce another class like:
class User:
pass
How can I create a method within this new class to print out self.price? My attempts using inheritance have resulted in an error (AttributeError: User instance has no attribute 'price'), suggesting that only methods can be passed down, not attributes.