Forem: Samuel Kling

Unleashing Real-Time Magic with Server-Sent Events (SSE), Go, and HTMX

Samuel Kling — Wed, 04 Oct 2023 19:43:44 +0000

Hey there fellow developers, today, we're diving into the world of real-time web applications using Server-Sent Events (SSE), the Go programming language, and the incredible HTMX library. Buckle up because this combo is going to take your web development game to a whole new level!

The Power of Server-Sent Events (SSE)

Let's start with SSE, shall we? SSE is like having a direct hotline from your server to your web browser, allowing real-time updates without all the fuss and complexity of other methods. Here's why SSE rocks:

Real-Time Updates Made Easy: SSE allows your server to push updates to the client over a single, long-lived HTTP connection. Say goodbye to endless polling and WebSocket setup headaches.

Lightweight and Nimble: SSE uses a lightweight, text-based format (usually JSON), keeping things efficient. No unnecessary overhead here, which is excellent news for your bandwidth and server resources.

Browser Love: SSE enjoys wide browser support. Chrome, Firefox, Safari, Edge—you name it—they're all onboard, making SSE accessible to the masses.

Simplicity Rules: SSE is easy to implement on both the server and client sides. It's all about standard HTTP requests and event listeners, making integration into existing apps a breeze.

When to Unleash SSE

Now that you're pumped about SSE, let's talk about when to use it. SSE is your go-to for real-time updates without the complications. Here's when to drop the SSE magic:

Live Notifications: Imagine sending live notifications to users—new messages, likes, comments—SSE makes it a walk in the park.

Monitoring Mastery: Need real-time server metrics or application health updates? SSE's got your back.

Collaboration Central: In collaborative apps like Google Docs, SSE syncs changes from multiple users in real time, creating a seamless experience.

Gaming Galore: SSE can keep your online game's state and player actions in sync, delivering a gaming experience that keeps players glued to their screens.

Go and HTMX: A Dynamic Duo for SSE

Now, here's where the real magic happens—pairing SSE with Go and HTMX. Check this out:

Go: Go, the superhero of languages, steps up to the plate on the server side. With Go's goroutines, managing those long-lived connections is a breeze. Plus, it comes equipped with an HTTP server in its standard library, the perfect match for serving SSE events.

// main.go
package main

import (
    "context"
    "fmt"
    "net/http"
    "time"
)

func main() {

    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        http.ServeFile(w, r, "sse.html")
    })

    http.HandleFunc("/events", func(w http.ResponseWriter, r *http.Request) {
        // Set headers for SSE
        w.Header().Set("Content-Type", "text/event-stream")
        w.Header().Set("Cache-Control", "no-cache")
        w.Header().Set("Connection", "keep-alive")

        // Create a channel to send data
        dataCh := make(chan string)

        // Create a context for handling client disconnection
        _, cancel := context.WithCancel(r.Context())
        defer cancel()

        // Send data to the client
        go func() {
            for data := range dataCh {
                fmt.Fprintf(w, "data: %s\n\n", data)
                w.(http.Flusher).Flush()
            }
        }()

        // Simulate sending data periodically
        for {
            dataCh <- time.Now().Format(time.TimeOnly)
            time.Sleep(1 * time.Second)
        }
    })

    fmt.Printf("Server ready: http://localhost:%s\n", PORT)
    http.ListenAndServe(":"+PORT, nil)
}

HTMX: HTMX, our frontend ally, adds dynamic, AJAX-driven behavior to your web pages. The beauty is in its simplicity. No more writing complex WebSocket code. With HTMX, you can integrate SSE seamlessly into your HTML without breaking a sweat.

<!-- sse.html -->
<html>
    <head>
        <title>Go SSE</title>

        <script src="https://unpkg.com/htmx.org@1.9.6"></script>
        <script src="https://unpkg.com/htmx.org/dist/ext/sse.js"></script>
    </head>
    <body>
        <h1>SSE Example with HTMX</h1>
        <div hx-ext="sse" sse-connect="/events" sse-swap="message">
            Contents of this box will be updated in real time with every SSE message received from the chatroom.
        </div>
    </body>
</html>

Frontend Simplified: HTMX abstracts the complexity of SSE, meaning you can focus on your app's logic instead of wrestling with WebSockets and custom event handling.

Scalability Mastered: Go's performance and concurrency capabilities make it a juggernaut for handling countless SSE connections simultaneously. Whether you're serving updates to a few users or an army, Go's got it covered.

In a nutshell, SSE with Go and HTMX is like a match made in developer heaven. It simplifies development and delivers a mind-blowing real-time experience to your users. Whether you're building a chat app, a monitoring dashboard, or a collaborative tool, this combo will take your app to the next level.

Ready to unleash the power of SSE with Go and HTMX? Let's get coding and create web applications that redefine real-time interactivity.

Remember, the magic happens when you code, so go forth, fellow devs, and make the web a real-time wonderland!

And that's a wrap, folks! Until next time, keep coding, keep innovating, and stay legendary! 🚀✨

Use Windows Data Protection API with Python for handling credentials.

Samuel Kling — Wed, 12 Jan 2022 21:01:15 +0000

As a IT Tech, I do alot of automation scripting, both in Powershell and Python against various systems and Ive never liked how I had to handle credentials in scripts.

I dont want to have any credentials or API-keys in plain text on a server that others have access to, so I saved it as environment variables like most of us do.
That works fine, but when you have hundreds of variables for email accounts, API-keys and SFTP accounts it can get messy.

When I looked for a better solution I found this gem for Powershell!

All commands below are run from PowerShell.

Prompt for Username and Password and save to file

PS C:\> Get-Credential | Export-Clixml -Path "cred.xml"

Import the credentials from a file to a PSCredential object.

PS C:\> $cred = Import-Clixml -Path "cred.xml"
PS C:\> $cred

UserName                     Password
--------                     --------
samkling System.Security.SecureString
PS C:\> ConvertFrom-SecureString $cred.password -AsPlainText

password

ConvertFrom-SecureString -AsPlainText requires PowerShell 7.0.
Export-Clixml only exports encrypted credentials on Windows.

The Export-Clixml cmdlet encrypts credential objects by using the Windows Data Protection API . The encryption ensures that only your user account on only that computer can decrypt the contents of the credential object. The exported CLIXML file can't be used on a different computer or by a different user.

I now store the credentials neatly, and secure in a credentials.xml file in the same directory as the actual script. Anyone can access the credential file and the script, but they wont be able to decrypt

.
├─ company1-sftp-script
│  ├─ download-files-newer-than-1-day.ps1
│  └─ credentials.xml
└─ company2-sftp-script
   ├─ download-files-newer-than-1-day.ps1
   └─ credentials.xml

How can we use the same method in Python?

Sadly there is no Export-Clixml/Import-Clixml equalent for Python so we will have to build it ourselves.

First we need to have access Windows Data Protection API. There are several ways, I use pywin32.

PS C:\> pip install pywin32

And then we need to create two files in python.

# export_clixml.py
import win32crypt
import binascii
import sys


def export_clixml(username, password):

    # encrypt the password with DPAPI.
    crypted_password = win32crypt.CryptProtectData(
        password.encode("utf-16-le"), None, None, None, None, 0
    )

    # Do some magic to return the password in the exact same format as if you would use Powershell.
    password_secure_string = binascii.hexlify(crypted_password).decode()

    # Use the same xml format as for powershells Export-Clixml, just replace values for username and password.
    xml = f"""<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
    <Obj RefId="0">
        <TN RefId="0">
        <T>System.Management.Automation.PSCredential</T>
        <T>System.Object</T>
        </TN>
        <ToString>System.Management.Automation.PSCredential</ToString>
        <Props>
        <S N="UserName">{username}</S>
        <SS N="Password">{password_secure_string}</SS>
        </Props>
    </Obj>
    </Objs>"""

    return xml


if __name__ == "__main__":
    if len(sys.argv) == 3:
        # Dont do this, It's just so that we can pipe the output to file to mimic the powershells version.
        print(export_clixml(sys.argv[1], sys.argv[2]))

# import_clixml.py
import win32crypt
import binascii
import sys


def import_clixml(filename):

    with open(filename, "r", encoding="utf-8") as f:
        xml = f.read()

        # Extract username and password from the XML since thats all we care about.
        username = xml.split('<S N="UserName">')[1].split("</S>")[0]
        password_secure_string = xml.split('<SS N="Password">')[1].split("</SS>")[0]

        # CryptUnprotectDate returns two values, description and the password, 
        # we dont care about the description, so we use _ as variable name.
        _, decrypted_password_string = win32crypt.CryptUnprotectData(
            binascii.unhexlify(password_secure_string), None, None, None, 0
        )

        return f"{username}, {decrypted_password_string.decode()}"


if __name__ == "__main__":
    # We use sys args just to mimic the powershell version.
    if len(sys.argv) == 2:
        print(import_clixml(sys.argv[1]))

Lets try it out and see if we can use Powershells Export-Clixml and Pythons Import-Clixml.

PS C:\> Get-Credential | Export-Clixml -Path powershell_cred.xml 

PowerShell credential request
Enter your credentials.
User: samkling
Password: password

PS C:\> py .\Import_Clixml.py .\powershell_cred.xml

samkling, password

Sweet, so it returned the correct username and password decrypted.

What about the other way around? From Python to Powershell?

PS C:\> $cred = Import-Clixml -Path .\python_cred.xml
PS C:\> $cred

UserName                     Password
--------                     --------
samkling System.Security.SecureString

PS C:\> ConvertFrom-SecureString $cred.password -AsPlainText

password

How cool is that!