Python HTTP/1.1 Server

A dependency-free HTTP/1.1 server built directly on Python sockets. The project demonstrates request parsing, persistent connections, bounded concurrency, static-file streaming, JSON uploads, and basic path/host validation without a web framework.

Highlights

• Fixed worker pool with a bounded queue and 503 Service Unavailable under saturation
• HTTP/1.0 and HTTP/1.1 connection handling with keep-alive time and request limits
• Static HTML, CSS, JavaScript, text, and image responses streamed in 8 KB chunks
• POST /upload validation for UTF-8 JSON bodies
• Canonical path checks that keep file access inside resources/
• Host-header validation for the configured local address and port
• Dependency-free automated unit tests for parsing, path safety, response headers, and connection policy

Architecture

TCP listener
  -> bounded connection queue
  -> fixed worker threads
  -> HTTP request parser
  -> host/path/content validation
  -> static-file response or JSON upload

Run locally

Requires Python 3.10 or newer. From the repository root:

python3 server.py

Optional positional arguments set the port, host, and worker count:

python3 server.py 8080 127.0.0.1 10

Then open http://127.0.0.1:8080.

API examples

Fetch the home page:

curl -i http://127.0.0.1:8080/

Upload JSON:

curl -i -X POST http://127.0.0.1:8080/upload \
  -H 'Content-Type: application/json' \
  -d '{"hello":"world"}'

Check traversal protection (the client must preserve the path):

curl -i --path-as-is http://127.0.0.1:8080/../etc/passwd

Tests

python3 -m unittest discover -s tests -v

The streaming test creates a deterministic multi-chunk payload in a temporary directory. Large generated binaries are not stored in the repository.

Project structure

server.py          Socket server, worker pool, parser, and handlers
resources/         Static demo files
resources/uploads/ Runtime JSON uploads (ignored by Git)
tests/             Dependency-free unit tests

Scope and limitations

• This is an educational server, not a production replacement for a hardened HTTP server or reverse proxy.
• Request headers and bodies are capped at 8 KB; chunked transfer encoding, TLS, range requests, and HTTP/2 are intentionally out of scope.
• Uploads are stored on the local filesystem and are not authenticated.
• The thread pool is process-local and has no graceful drain or multi-process coordination.

The original coursework attribution is preserved in Git history; this README focuses on the engineering decisions a reviewer can verify in the repository.