<h2 id="introduction">Introduction</h2>
The switch statement is a powerful and convenient tool for controlling the flow of your program. It allows you to quickly and easily create multiple branches of code, depending on the value of a given variable or expression. It's commonly used when you need to execute different logic depending on a given variable's value, which can have more than 2 (but a finite number) of values.
In this article, we will explore how to use the switch statement in Python and discuss its advantages over other control structures. Whether you are new to Python or an experienced developer, the switch statement can help you write cleaner, more efficient code.
<h2 id="beforev310">Before v3.10</h2>
Before the Python switch statement was natively available in the language, programmers had to use other control structures to achieve the same functionality. One common approach was to use a series of if-else statements, with each branch of code being associated with a different value of the variable being tested.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

if value == &quot;foo&quot;:
 print(&quot;foo was selected&quot;)
elif value == &quot;bar&quot;:
 print(&quot;bar was selected&quot;)
else:
 print(&quot;Nothing valid was selected&quot;)
</code></pre>
In this code, we are using an if-else statement to determine which branch of code to execute based on the value of the variable <code>value</code>. If <code>value</code> is equal to &quot;foo&quot;, the first branch of code will be executed. If <code>value</code> is equal to &quot;bar&quot;, the second branch of code will be executed. Otherwise, the code in the <code>else</code> block will be executed.
While this approach works, it can quickly become unwieldy as the number of possible values for the variable increases. In addition, it can make the code difficult to read and understand.
Another approach that can be used to create a switch-like statement in Python is to use a dictionary. In this approach, the keys of the dictionary are the possible values of the variable being tested, and the values are the corresponding branches of code.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

switch = {
 &quot;foo&quot;: lambda: print(&quot;foo was selected&quot;),
 &quot;bar&quot;: lambda: print(&quot;bar was selected&quot;),
 &quot;default&quot;: lambda: print(&quot;Nothing valid was selected&quot;),
}

switch.get(value, &quot;default&quot;)()
</code></pre>
In this code, we have defined a dictionary called <code>switch</code>, with keys representing the possible values of the variable <code>value</code>. For each key, we have assigned a lambda function as the value, which contains the corresponding branch of code. To execute the appropriate branch of code, we use the <code>get()</code> method of the dictionary, which allows us to specify a default value to use if the given key does not exist in the dictionary.
While this approach is more flexible and compact than using if-else statements, it can still be difficult to read and understand, especially if the code in each branch is complex. In addition, it requires the use of lambda functions, which can be confusing for some programmers. We don't suggest using this method unless for some reason you can't use the other methods in this article.
With the introduction of the Python switch statement in Python v3.10, programmers now have a more convenient and intuitive way to control the flow of their programs based on the value of a given variable or expression. In the next section, we will explore how to use an actual switch statement in Python.
<h2 id="thematchcasestatementafterv310">The <code>match</code>/<code>case</code> Statement (after v3.10)</h2>
After Python v3.10, the switch statement is handled using the <code>match</code> keyword. This keyword is used to create a pattern-matching expression, which allows you to test the value of a given variable or expression against a series of patterns. If a match is found, the corresponding branch of code is executed.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

match value:
 case &quot;foo&quot;:
 print(&quot;foo was selected&quot;)
 case &quot;bar&quot;:
 print(&quot;bar was selected&quot;)
 case _:
 print(&quot;Nothing valid was selected&quot;)
</code></pre>
In this code, we are using the <code>match</code> keyword to create a pattern-matching expression, which tests the value of the variable <code>value</code> against a series of patterns. If <code>value</code> is equal to &quot;foo&quot;, the first branch of code will be executed. If <code>value</code> is equal to &quot;bar&quot;, the second branch of code will be executed. Otherwise, the code in the else block will be executed.
<h3 id="fallthrough">Fall-through</h3>
One of the key differences between switch statements in Python and traditional switch statements in other languages is that Python's <code>match</code> statement does not support fall-through. In other words, once a match is found and the corresponding branch of code is executed, the <code>match</code> expression ends and no other code in the <code>match</code> statement is executed. In other languages, this is usually achieved using the <code>break</code> keyword, which is not needed or supported here.
If you want to achieve the same behavior as fall-through in a traditional switch statement, you can use the <code>|</code> operator to match multiple cases. This operator allows you to specify multiple patterns in a single <code>case</code>, and any of the patterns can be matched to trigger the execution of that branch.
For example, consider the following code:
<pre><code class="hljs">value = &quot;y&quot;

match value:
 case &quot;yes&quot; | &quot;y&quot;:
 print(&quot;The user confirmed&quot;)
 case _:
 print(&quot;The user denied&quot;)
</code></pre>
Here, if the value of <code>value</code> is equal to &quot;yes&quot; or &quot;y&quot;, the first branch of code will be executed. This is equivalent to the fall-through behavior in a traditional switch statement.
<h3 id="defaults">Defaults</h3>
As you've probably noticed from the above examples, the &quot;default&quot; case is handled using an underscore (<code>_</code>). This is considered the &quot;wildcard&quot; and matches all values. If one of the previous cases matches the value, then the default code branch is skipped over and not executed.
<h2 id="conclusion">Conclusion</h2>
As you can see, the Python match (aka &quot;switch&quot;) statement offers a powerful and convenient way to control the flow of your program. Whether you are new to Python or an experienced developer, the switch statement can help you write cleaner, more efficient code.

Guest Contributor

The Python Switch Statement

Scott Robinson

David Landup

Dimitrije Stamenic

In this guide - learn the basics of testing in JavaScript with Mocha and Chai - focusing on Unit Testing and creating test suites, with practical code examples.

Testing Node.js Code with Mocha and Chai

Uchechukwu Azubuko

In this in-depth guide, we will create a React app and cover a complete guide to how we can perform unit tests on the React application using _Jest_ and _React Testing Library_ so that you can hone your testing skills and learn how to create a tame React application.

Definitive Guide to Unit Testing in React Applications with Jest and React-Testing

<h2 id="introduction">Introduction</h2>
The security of users and their personal data while using a web application is paramount. While this guiding principle has been acknowledged even from the early stages of web development - bad actors find loopholes in applications, and may exploit your users.
<blockquote>
Many &quot;standard&quot; attacks are well-known and documented, and protection from them isn't hard. To unburden the developer from implementing security practices themselves, frameworks like Spring Boot have abstracted away various security measures and allow you to simply apply security filters in your applications to prevent well-known attacks.
</blockquote>
In this short guide, we'll take a look at what Cross-Site Scripting (XSS) is, how someone could perform this attack on your own application, and how you can prevent it easily with Spring Boot.
<h2 id="whatiscrosssitescriptingxss">What is Cross-Site Scripting (XSS)?</h2>
Cross-Site Scripting is a well-known, widely spread exploit, in which a bad actor injects a script into a web application.
Typically, a same-origin policy is applied to web applications, which restricts scripts in a web page to access data from sources if their origins don't match. Under the same-origin policy - if a page from a trusted website may access data interfacing with the user (such as cookies, for example), other pages from the same origin may do so as well. This form of access-control seemed sufficient to protect the integrity of data on web applications at the time.
Cross-Site Scripting circumvents the same-origin policy, by injecting a malicious script into a trusted website's page. Since the script is run from a trusted website, it's executed as a trusted script. There was no clear-cut way to differentiate between malicious scripts and non-malicious scripts - so arbitrary code execution was possible with Cross-Site Scripting. This ranges anywhere from inserting annoying alerts, to social engineering attacks, silently collecting user information, or redirecting users to phishing pages that appear to be parts of trusted websites.
Many websites are susceptible to Cross-Site Scripting attacks, and it remains a common attack today, even though this type of exploit has been known since the 90s.
<h2 id="preventingxssinaspringbootapplicationwithcontentsecuritypolicycsp">Preventing XSS in a Spring Boot Application with Content-Security Policy (CSP)</h2>
Spring Boot takes security seriously, and Spring's Security module implements flexible and powerful security practices that allows developers to minimize their worry when it comes to security, which oftentimes requires a low-level understanding of the principles of the way messages are being exchanged in a web application.
By default, Spring Boot implements several security headers:
<pre><code class="hljs">Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
</code></pre>
X-XSS-Protection is included by default! This security header attempts to detect XSS attempts, and blocks them. This isn't a fail-proof process though, and browsers have different implementations of detectors. Some browsers, like Chrome, have even removed their XSS Auditor. Additionally, the automated detection works for Reflected XSS Attacks, while other types of attacks also exist.
A more modern alternative to X-XSS-Protection is the Content-Security Policy (CSP), which primarily deal with policies on which resources can be loaded, from which origins, and at which endpoints. As of 2022, CSP is the best prevention measure against XSS, Clickjacking and other types of attacks. Not all browsers implement CSP, which is why it's not included in the security headers by default.

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 <div class="w-full">
 Note: Even with CSP in place, it's always the best course of action to validate any user input and make sure that it's safe to process using your system, to prevent code injection.

 </div>
 </div>
 </div>
 In Spring Boot - to configure custom web security measures, you'll typically extend the <code>WebSecurityConfigurerAdapter</code> class, and override the <code>configure()</code> method:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
 .headers()
 .contentSecurityPolicy(&quot;csp-directives&quot;);
 }
}
</code></pre>
Where the content security policy directives (supplied as a <code>;</code>-separated string) depend on your use-case and which sources you wish to trust:
<pre><code class="hljs">Content-Security Policy: directive1; directive2; directive3; ... directiveN;
</code></pre>
For example, a web application can list trusted websites from which scripts can be loaded with:
<pre><code class="hljs">script-src https://trusted.com;
</code></pre>
Or you can skip trusting any third-party website:
<pre><code class="hljs">script-src self;
</code></pre>
Similarly, an application can trust plugins:
<pre><code class="hljs">object-src https://trusted.com
</code></pre>
There's a wide variety of directives you can supply, including:
<ul>
<li><code>default-src</code> - Default fallback</li>
<li><code>child-src</code> - Valid web worker sources</li>
<li><code>frame-src</code> - Valid sources for <code>&lt;frame&gt;</code>s and <code>&lt;iframe&gt;</code>s</li>
<li><code>img-src</code> - Valid sources for images</li>
<li><code>media-src</code> - Valid sources for <code>&lt;audio&gt;</code>, <code>&lt;video&gt;</code> and <code>&lt;track&gt;</code> tags</li>
<li><code>script-src</code> - Valid script sources (helps prevent XSS)</li>
<li><code>style-src</code> - Valid sources for <code>&lt;style&gt;</code> elements</li>
<li><code>base-uri</code> - Restricts resources accessible from the <code>&lt;base&gt;</code> element</li>
<li><code>frame-ancestors</code> - Valid parents of <code>&lt;frame&gt;</code> <code>&lt;iframe&gt;</code>, <code>&lt;embed&gt;</code>, <code>&lt;applet&gt;</code>, etc. elements</li>
<li>etc.</li>
</ul>

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 <div class="w-full">
 Note: For the full list of accepted CSP directives, take a look at <a target="_blank" rel="nofollow noopener noreferrer" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy">MDN's Documentation</a>.

 </div>
 </div>
 </div>
 For example, here's a safe set of policy directives:
<pre><code class="hljs">script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:;
object-src &#x27;none&#x27;;
base-uri &#x27;none&#x27;;
require-trusted-types-for &#x27;script&#x27;;
report-uri https://csp.example.com;
</code></pre>
Let's add these to our Spring Boot application:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
 .headers()
 .contentSecurityPolicy(&quot;script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:; object-src &#x27;none&#x27;; base-uri &#x27;none&#x27;; require-trusted-types-for &#x27;script&#x27;; report-uri https://csp.example.com;&quot;);
 }
}
</code></pre>
You can use the <a rel="nofollow noopener noreferrer" target="_blank" href="https://csp-evaluator.withgoogle.com/">CSP-Evaluator</a> to evaluate whether your CSP directives are valid and safe, and it'll point out which directives are easily exploitable. Here's a CSP-directive that allows for Google APIs:
<pre><code class="hljs">default-src &#x27;self&#x27;;
object-src &#x27;none&#x27;;
frame-src &#x27;self&#x27; data:; 
script-src &#x27;self&#x27; &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; https://storage.googleapis.com; 
style-src &#x27;self&#x27; &#x27;unsafe-inline&#x27;; 
img-src &#x27;self&#x27; data:; 
font-src &#x27;self&#x27; data:;
base-uri &#x27;self&#x27;
</code></pre>
<h2 id="conclusion">Conclusion</h2>
In this short guide, we've taken a look at what Cross-Site Scripting (XSS) is, and how it works at a holistic level. Then, we've explored some XSS prevention measures that can easily be implemented with Spring Boot to make your applications safe, and set a Content-Security Policy (CSP).
Finally, we've explored CSP directives and took a look at a couple of different safe policies.

In this short guide, learn how to make your Java-based Spring Boot application safe against cross-site scripting (XSS) attacks, using CSP (Content-Safety Policy) and learn about CSP directives.

Prevent Cross-Site Scripting (XSS) in Spring Boot with Content-Security Policies (CSPs)

Cássia Sampaio

In this practical, hands-on, in-depth guide - learn everything you need to know about decision trees, ensembling them into random forests and going through an end-to-end mini project using Python and Scikit-Learn.

Definitive Guide to the Random Forest Algorithm with Python and Scikit-Learn

In this guide - learn how to check whether a string contains a digit, number, numeric representation or decimal using various methods, map(), any(), RegEx and lambda functions in Python, with performance benchmarks!

Check if String Contains a Number in Python

In this tutorial, you'll learn how to parse, read, and write JSON to files in Python through examples, using load(), loads(), dump() and dumps() methods. We'll also cover pretty-printing and sorting, enabling or disabling NaN checks, circular references, etc.

Reading and Writing JSON to a File in Python

Arpendu Kumar Garai

In this in-depth guide, learn all you need to know about setting up and using AWS Simple Email Service (SES) in Java with Spring Boot and Spring Cloud.

Guide to Simple Email Service (AWS SES) with Spring Boot and Spring Cloud

In this guide - learn how to properly handle exceptions and errors in Express/Node in JavaScript, with practical code samples and best practices.