<h2 id="whatarelambdafunctions">What are Lambda Functions?</h2>
​ 
In Python, functions are objects: they can be assigned to variables, can be returned from other functions, stored in lists or dicts and passed as parameters for other functions. Consider, for example, the <code>map()</code> built-in function. Its syntax is <code>map(function, iterable)</code> and it is used to handily apply <code>function</code> to every element of <code>iterable</code>.
<blockquote>
<code>map()</code> actually returns an <code>iterator</code> object. In practice, we cast the result as a <code>list</code>, <code>tuple</code>, <code>set</code>, <code>dict</code>, etc, whichever is more convenient. 
​ 
Suppose that you want to square every term of a list using the <code>map()</code> function. In order to do that, we'll define a <code>square()</code> function and use it as parameter for <code>map()</code>:
</blockquote>
<pre><code class="hljs">my_list = [1,2,3,4,5]
def square(x):
 return x**2

my_modified_list = list(map(square, my_list))
print(my_modified_list)
</code></pre>
<pre><code class="hljs">[1, 4, 9, 16, 25]
</code></pre>
​ 
However, if the only use of our <code>square()</code> function is to create this list, it is cleaner to use a <code>lambda</code> function:
<pre><code class="hljs">my_list = [1,2,3,4,5]
my_modified_list = list(map(lambda x: x**2, my_list))
print(my_modified_list)
</code></pre>
<pre><code class="hljs">[1, 4, 9, 16, 25]
</code></pre>
In Python, <code>lambda</code> functions are anonymous functions that take their name and syntax from Alonzo Church's <a rel="nofollow noopener noreferrer" target="_blank" href="https://en.wikipedia.org/wiki/Lambda_calculus">Lambda calculus</a>. Their syntax is:
<pre><code class="hljs">lambda x_1,..., x_n : expression(x_1, ..., x_n)
</code></pre>
This creates an anonymous function that receives as input the variables <code>x_1, ..., x_n</code> and returns the evaluated <code>expression(x_1, ..., x_n)</code>. 
​ 
The purpose of <code>lambda</code> functions is to be used as parameters for functions that accept functions as parameters, as we did with <code>map()</code> above. Python allows you to assign a <code>lambda</code> function to a variable, but the <a rel="nofollow noopener noreferrer" target="_blank" href="https://peps.python.org/pep-0008/">PEP 8 style guide</a> advises against it. If you want to assign a simple function to a variable, it is better to do it as a one-line definition. This ensures the resulting object is properly named, improving traceback readability:
<pre><code class="hljs">anonymous_square = lambda x : x**2
​
def named_square(x): return x**2
​
print(anonymous_square.__name__)
print(named_square.__name__)

# Works even if you reassign the functions
a = anonymous_square
b = named_square
print(a.__name__)
print(b.__name__)
</code></pre>
<h2 id="whyuselambdafunctions">Why Use Lambda Functions?</h2>
After the last paragraph, you might be wondering why you would want to use a <code>lambda</code> function. After all, anything that can be done with a <code>lambda</code> function could be done with a named function. 
​ 
The answer to this is that the <code>lambda</code> function's purpose is to live inside larger expressions representing a computation. One way to think about this is by analogy with variables and values. Consider the following code:
<pre><code class="hljs">x = 2
</code></pre>
The variable <code>x</code> is a placeholder (or a name) for the integer <code>2</code>. For instance, calling <code>print(x)</code> and <code>print(2)</code> gives exactly the same output. In the case of functions:
<pre><code class="hljs">def square(x): return x**2
</code></pre>
The function <code>square()</code> is a placeholder for the computation of squaring a number. This computation can be written in a nameless way as <code>lambda x: x**2</code>. 
​ 
Following this philosophical digression, let's see some examples of applications for <code>lambda</code> functions. 
​
<h3 id="usinglambdawiththesortedfunction">Using Lambda with the sorted() Function</h3>
The <code>sorted()</code> function sorts an iterable. It accepts a function as its <code>key</code> argument, and the result of the function applied to each element of the iterable is used to order the elements. 
​ 
This is perfectly suited to a <code>lambda</code> function: by setting the <code>key</code> parameter with a <code>lambda</code> function, we can sort by any kind of attribute of the elements. For example, we can sort a list of names by surname:
<pre><code class="hljs">name_list = [&#x27;Grace Hopper&#x27;, &#x27;Ada Lovelace&#x27;, &#x27;Emmy Noether&#x27;, &#x27;Marie Curie&#x27;]
​
sorted_by_surname = sorted(name_list, key = lambda x: x.split()[1])
​
print(sorted_by_surname)
</code></pre>
<pre><code class="hljs">[&#x27;Marie Curie&#x27;, &#x27;Grace Hopper&#x27;, &#x27;Ada Lovelace&#x27;, &#x27;Emmy Noether&#x27;]
</code></pre>
<h3 id="usinglambdawithfilterfunction">Using Lambda with 'filter()' Function</h3>
The <code>filter()</code> function has the following syntax: <code>filter(function, iterable)</code> and it outputs the elements of <code>iterable</code> which evaluate <code>function(element)</code> as true (it is similar to an <code>WHERE</code> clause in SQL). We can use <code>lambda</code> functions as parameters for <code>filter()</code> to select elements from an iterable.
Consider the following example:
<pre><code class="hljs">num_list = list(range(0,100))
​
multiples_of_15= filter(lambda x: (x % 3 == 0) and (x % 5 == 0), num_list)
​
print(list(multiples_of_15))
</code></pre>
<pre><code class="hljs">[0, 15, 30, 45, 60, 75, 90]
</code></pre>
<code>filter()</code> applies the <code>lambda</code> function <code>lambda x: (x % 3 == 0) and (x % 5 == 0)</code> to each element of <code>range(0,100)</code>, and returns a <code>filter</code> object. We access the elements by casting it as <code>list</code>. 
​
<h3 id="usinglambdawiththemapfunction">Using Lambda with The map() Function</h3>
​ 
Our last example is something we've seen in the introduction - the <code>map()</code> function. The <code>map()</code> function syntax is: <code>map(function, iterable)</code>, and <code>map()</code> applies <code>function</code> to each element of <code>iterable</code>, returning a <code>map</code> object that can be accessed by casting to a <code>list</code>.
We've seen how this can be applied to lists, but it could be applied to dicts using the <code>dict.items()</code> method:
<pre><code class="hljs">my_data = {&#x27;Mary&#x27;:1, &#x27;Alice&#x27;:2, &#x27;Bob&#x27;:0}
map_obj = map(lambda x: f&#x27;{x[0]} had {x[1]} little lamb&#x27;, my_data.items())
print(&#x27;, &#x27;.join((map_obj)))
</code></pre>
<pre><code class="hljs">Mary had 1 little lamb, Alice had 2 little lamb, Bob had 0 little lamb
</code></pre>
or to a string:
<pre><code class="hljs">my_string = &#x27;abcdefg&#x27;
&#x27;&#x27;.join(map(lambda x: chr(ord(x)+2),my_string))
</code></pre>
<pre><code class="hljs">&#x27;cdefghi&#x27;
</code></pre>
We can use the <code>map()</code> function in ingenious ways - one example is applying many functions to the same input.
For example, suppose you are making an API that receives a text string, and you want to apply a list of functions to it.
Each function extracts some feature from the text. The features we want to extract are the number of words, the second word and the fourth letter of the fourth word:
<pre><code class="hljs">def number_of_words(text):
 return len(text.split())
​
def second_word(text):
 return text.split()[1]
​
def fourth_letter_of_fourth_word(text):
 return text.split()[3][3]
​
function_list = [number_of_words, second_word, fourth_letter_of_fourth_word]
​
my_text = &#x27;Mary had a little lamb&#x27;
map_obj = map(lambda f: f(my_text), function_list)
​
feature_list = list(map_obj)
​
print(feature_list)
</code></pre>
<pre><code class="hljs">[5, &#x27;had&#x27;, &#x27;t&#x27;]
</code></pre>
​
<h2 id="conclusion">Conclusion</h2>
​ 
In this guide, we've explored the functionality of <code>lambda</code> functions in Python. We've seen that <code>lambda</code> functions are anonymous functions to be used as an inline function parameter for other functions. We've seen some use cases as well as when not to use them. 
​ 
When programming, it is important to keep in mind Donald Knuth's quote: &quot;Programs are meant to be read by humans and only incidentally for computers to execute.&quot; With this in mind, <code>lambda</code> functions are a useful tool to simplify our code, but should be used wisely.

David Landup

Felipe Antunes

Lambda Functions in Python

Uchechukwu Azubuko

In this guide - learn how to upload files in a drop area with HTML, CSS, Vanilla JavaScript, and with a loading animation and animated UX/UI.

Upload File with Vanilla JavaScript and Loading Animation

<h2 id="howtoconvertjsontopythonobject">How to convert JSON to Python Object</h2>
Python's <code>json</code> library has many utilities for encoding and decoding data in JSON format. In particular, the <code>json.load()</code> method decodes an JSON read as a file, and the <code>json.loads()</code> decode an JSON read as a string. In general, when decoding JSON files, the data is converted to Python dictionaries, but it is possible to convert it to a custom object by using the parameter <code>object_hook</code>.
For instance, suppose you have the following JSON object:
<pre><code class="hljs">json_obj = &quot;&quot;&quot;{
 &quot;name&quot; : &quot;Felipe&quot;,
 &quot;email&quot; : &quot;felipe@email.com&quot;,
 &quot;age&quot; : 29
}&quot;&quot;&quot;
</code></pre>
and the following class:
<pre><code class="hljs">class User():
 name : str
 email : str
 age : int
 def __init__(self, input):
 self.name = input.get(&quot;name&quot;)
 self.email = input.get(&quot;email&quot;)
 self.age = input.get(&quot;age&quot;)
</code></pre>
If we call <code>json.loads()</code> with <code>User</code> as the <code>object_hook</code> parameter, the <code>User.__init__()</code> method will be called with the JSON's corresponding <code>dict</code> as input.
<pre><code class="hljs">import json

user = json.loads(json_obj, object_hook = User)
print(f&quot;User {user.name}, age {user.age}, email {user.email}&quot;)
</code></pre>
<pre><code class="hljs">User Felipe, age 29, email felipe@email.com
</code></pre>
<blockquote>
But what if you have a nested JSON?
</blockquote>
<code>json.loads()</code> actually calls the <code>object_hook</code> function every time it reads a fully formed JSON object from the string. Consider the following JSON, returned from the <a target="_blank" rel="nofollow noopener noreferrer" href="https://randomuser.me/api/">Random User Generator API</a>
<pre><code class="hljs">json_obj = &quot;&quot;&quot;{
 &quot;gender&quot;: &quot;male&quot;,
 &quot;name&quot;: {
 &quot;title&quot;: &quot;Mr&quot;,
 &quot;first&quot;: &quot;Ian&quot;,
 &quot;last&quot;: &quot;Walters&quot;
 },
 &quot;location&quot;: {
 &quot;street&quot;: {
 &quot;number&quot;: 3161,
 &quot;name&quot;: &quot;Saddle Dr&quot;
 },
 &quot;city&quot;: &quot;Bendigo&quot;,
 &quot;state&quot;: &quot;Western Australia&quot;,
 &quot;country&quot;: &quot;Australia&quot;,
 &quot;postcode&quot;: 4285,
 &quot;coordinates&quot;: {
 &quot;latitude&quot;: &quot;-84.7903&quot;,
 &quot;longitude&quot;: &quot;-29.1020&quot;
 },
 &quot;timezone&quot;: {
 &quot;offset&quot;: &quot;+9:00&quot;,
 &quot;description&quot;: &quot;Tokyo, Seoul, Osaka, Sapporo, Yakutsk&quot;
 }
 },
 &quot;email&quot;: &quot;ian.walters@example.com&quot;,
 &quot;login&quot;: {
 &quot;uuid&quot;: &quot;6ee5b2e8-01c3-4314-8f7f-80059f5dd9ec&quot;,
 &quot;username&quot;: &quot;lazyzebra585&quot;,
 &quot;password&quot;: &quot;walter&quot;,
 &quot;salt&quot;: &quot;afXmogsa&quot;,
 &quot;md5&quot;: &quot;a40e87023b57a4a60c7cb398584cbac3&quot;,
 &quot;sha1&quot;: &quot;74caf43400be38cce60a8da2e6d1c367246505c2&quot;,
 &quot;sha256&quot;: &quot;1becdf34bcc6704726c7e9b38821a5792f9dd0689d30789fb5e099a6e51e860a&quot;
 },
 &quot;dob&quot;: {
 &quot;date&quot;: &quot;1947-06-06T02:45:41.895Z&quot;,
 &quot;age&quot;: 75
 },
 &quot;registered&quot;: {
 &quot;date&quot;: &quot;2003-03-25T00:15:32.791Z&quot;,
 &quot;age&quot;: 19
 },
 &quot;phone&quot;: &quot;06-9388-6976&quot;,
 &quot;cell&quot;: &quot;0469-101-424&quot;,
 &quot;id&quot;: {
 &quot;name&quot;: &quot;TFN&quot;,
 &quot;value&quot;: &quot;561493929&quot;
 },
 &quot;picture&quot;: {
 &quot;large&quot;: &quot;https://randomuser.me/api/portraits/men/32.jpg&quot;,
 &quot;medium&quot;: &quot;https://randomuser.me/api/portraits/med/men/32.jpg&quot;,
 &quot;thumbnail&quot;: &quot;https://randomuser.me/api/portraits/thumb/men/32.jpg&quot;
 },
 &quot;nat&quot;: &quot;AU&quot;
 }&quot;&quot;&quot;
</code></pre>
Let's print the decoded JSON at each step to see what happens:
<pre><code class="hljs">json.loads(json_obj, object_hook = print)
</code></pre>
<pre><code class="hljs">{&#x27;title&#x27;: &#x27;Mr&#x27;, &#x27;first&#x27;: &#x27;Ian&#x27;, &#x27;last&#x27;: &#x27;Walters&#x27;}
{&#x27;number&#x27;: 3161, &#x27;name&#x27;: &#x27;Saddle Dr&#x27;}
{&#x27;latitude&#x27;: &#x27;-84.7903&#x27;, &#x27;longitude&#x27;: &#x27;-29.1020&#x27;}
{&#x27;offset&#x27;: &#x27;+9:00&#x27;, &#x27;description&#x27;: &#x27;Tokyo, Seoul, Osaka, Sapporo, Yakutsk&#x27;}
{&#x27;street&#x27;: None, &#x27;city&#x27;: &#x27;Bendigo&#x27;, &#x27;state&#x27;: &#x27;Western Australia&#x27;, &#x27;country&#x27;: &#x27;Australia&#x27;, &#x27;postcode&#x27;: 4285, &#x27;coordinates&#x27;: None, &#x27;timezone&#x27;: None}
{&#x27;uuid&#x27;: &#x27;6ee5b2e8-01c3-4314-8f7f-80059f5dd9ec&#x27;, &#x27;username&#x27;: &#x27;lazyzebra585&#x27;, &#x27;password&#x27;: &#x27;walter&#x27;, &#x27;salt&#x27;: &#x27;afXmogsa&#x27;, &#x27;md5&#x27;: &#x27;a40e87023b57a4a60c7cb398584cbac3&#x27;, &#x27;sha1&#x27;: &#x27;74caf43400be38cce60a8da2e6d1c367246505c2&#x27;, &#x27;sha256&#x27;: &#x27;1becdf34bcc6704726c7e9b38821a5792f9dd0689d30789fb5e099a6e51e860a&#x27;}
{&#x27;date&#x27;: &#x27;1947-06-06T02:45:41.895Z&#x27;, &#x27;age&#x27;: 75}
{&#x27;date&#x27;: &#x27;2003-03-25T00:15:32.791Z&#x27;, &#x27;age&#x27;: 19}
{&#x27;name&#x27;: &#x27;TFN&#x27;, &#x27;value&#x27;: &#x27;561493929&#x27;}
{&#x27;large&#x27;: &#x27;https://randomuser.me/api/portraits/men/32.jpg&#x27;, &#x27;medium&#x27;: &#x27;https://randomuser.me/api/portraits/med/men/32.jpg&#x27;, &#x27;thumbnail&#x27;: &#x27;https://randomuser.me/api/portraits/thumb/men/32.jpg&#x27;}
{&#x27;gender&#x27;: &#x27;male&#x27;, &#x27;name&#x27;: None, &#x27;location&#x27;: None, &#x27;email&#x27;: &#x27;ian.walters@example.com&#x27;, &#x27;login&#x27;: None, &#x27;dob&#x27;: None, &#x27;registered&#x27;: None, &#x27;phone&#x27;: &#x27;06-9388-6976&#x27;, &#x27;cell&#x27;: &#x27;0469-101-424&#x27;, &#x27;id&#x27;: None, &#x27;picture&#x27;: None, &#x27;nat&#x27;: &#x27;AU&#x27;}
</code></pre>
So <code>json.loads()</code> calls the <code>object_hook</code> function every time it reads a fully formed JSON, that is, every time it closes a bracket pair <code>{}</code>. Then, it creates the whole JSON object by using the result of the <code>object_hook</code> function - note the <code>None</code> (the return value of <code>print</code>) in the last printed line.
We will show two work-arounds for this issue. The first is to modify our <code>User.__init__()</code> method to be more flexible with respect to the input. We will do this using the <code>__dict__</code> attribute. Every Python object has a <code>__dict__</code> attribute that holds every attribute's name and value. Our modified <code>__init__()</code> method will update this dictionary:
<pre><code class="hljs">class User():
 def __init__(self, input):
 self.__dict__.update(input)

user = json.loads(json_obj, object_hook = User)
print(f&quot;User {user.name.first} {user.name.last}, age {user.dob.age}, email {user.email}&quot;)
</code></pre>
<pre><code class="hljs">User Ian Walters, age 75, email ian.walters@example.com
</code></pre>
Another possible work-around is to use the <code>collections.namedtuple</code> class:
<pre><code class="hljs">from collections import namedtuple

def create_user(input):
 User = namedtuple(&#x27;User&#x27;, input.keys())
 return User(**input)
 
user = json.loads(json_obj, object_hook=create_user)
print(f&quot;User {user.name.first} {user.name.last}, age {user.dob.age}, email {user.email}&quot;)
</code></pre>
<pre><code class="hljs">User Ian Walters, age 75, email ian.walters@example.com
</code></pre>
where <code>namedtuple('User', input.keys())</code> creates a tuple subclass called <code>User</code> with the input's keys as attributes names, and <code>User(**input)</code> assigns the corresponding values for the attributes.

In this short tutorial, we'll take a look at how to convert JSON to a custom Python object - including nested JSON, using the built-in `json` library.

How to convert JSON to Python Object

<h2 id="introduction">Introduction</h2>
The switch statement is a powerful and convenient tool for controlling the flow of your program. It allows you to quickly and easily create multiple branches of code, depending on the value of a given variable or expression. It's commonly used when you need to execute different logic depending on a given variable's value, which can have more than 2 (but a finite number) of values.
In this article, we will explore how to use the switch statement in Python and discuss its advantages over other control structures. Whether you are new to Python or an experienced developer, the switch statement can help you write cleaner, more efficient code.
<h2 id="beforev310">Before v3.10</h2>
Before the Python switch statement was natively available in the language, programmers had to use other control structures to achieve the same functionality. One common approach was to use a series of if-else statements, with each branch of code being associated with a different value of the variable being tested.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

if value == &quot;foo&quot;:
 print(&quot;foo was selected&quot;)
elif value == &quot;bar&quot;:
 print(&quot;bar was selected&quot;)
else:
 print(&quot;Nothing valid was selected&quot;)
</code></pre>
In this code, we are using an if-else statement to determine which branch of code to execute based on the value of the variable <code>value</code>. If <code>value</code> is equal to &quot;foo&quot;, the first branch of code will be executed. If <code>value</code> is equal to &quot;bar&quot;, the second branch of code will be executed. Otherwise, the code in the <code>else</code> block will be executed.
While this approach works, it can quickly become unwieldy as the number of possible values for the variable increases. In addition, it can make the code difficult to read and understand.
Another approach that can be used to create a switch-like statement in Python is to use a dictionary. In this approach, the keys of the dictionary are the possible values of the variable being tested, and the values are the corresponding branches of code.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

switch = {
 &quot;foo&quot;: lambda: print(&quot;foo was selected&quot;),
 &quot;bar&quot;: lambda: print(&quot;bar was selected&quot;),
 &quot;default&quot;: lambda: print(&quot;Nothing valid was selected&quot;),
}

switch.get(value, &quot;default&quot;)()
</code></pre>
In this code, we have defined a dictionary called <code>switch</code>, with keys representing the possible values of the variable <code>value</code>. For each key, we have assigned a lambda function as the value, which contains the corresponding branch of code. To execute the appropriate branch of code, we use the <code>get()</code> method of the dictionary, which allows us to specify a default value to use if the given key does not exist in the dictionary.
While this approach is more flexible and compact than using if-else statements, it can still be difficult to read and understand, especially if the code in each branch is complex. In addition, it requires the use of lambda functions, which can be confusing for some programmers. We don't suggest using this method unless for some reason you can't use the other methods in this article.
With the introduction of the Python switch statement in Python v3.10, programmers now have a more convenient and intuitive way to control the flow of their programs based on the value of a given variable or expression. In the next section, we will explore how to use an actual switch statement in Python.
<h2 id="thematchcasestatementafterv310">The <code>match</code>/<code>case</code> Statement (after v3.10)</h2>
After Python v3.10, the switch statement is handled using the <code>match</code> keyword. This keyword is used to create a pattern-matching expression, which allows you to test the value of a given variable or expression against a series of patterns. If a match is found, the corresponding branch of code is executed.
For example, consider the following code:
<pre><code class="hljs">value = &quot;foo&quot;

match value:
 case &quot;foo&quot;:
 print(&quot;foo was selected&quot;)
 case &quot;bar&quot;:
 print(&quot;bar was selected&quot;)
 case _:
 print(&quot;Nothing valid was selected&quot;)
</code></pre>
In this code, we are using the <code>match</code> keyword to create a pattern-matching expression, which tests the value of the variable <code>value</code> against a series of patterns. If <code>value</code> is equal to &quot;foo&quot;, the first branch of code will be executed. If <code>value</code> is equal to &quot;bar&quot;, the second branch of code will be executed. Otherwise, the code in the else block will be executed.
<h3 id="fallthrough">Fall-through</h3>
One of the key differences between switch statements in Python and traditional switch statements in other languages is that Python's <code>match</code> statement does not support fall-through. In other words, once a match is found and the corresponding branch of code is executed, the <code>match</code> expression ends and no other code in the <code>match</code> statement is executed. In other languages, this is usually achieved using the <code>break</code> keyword, which is not needed or supported here.
If you want to achieve the same behavior as fall-through in a traditional switch statement, you can use the <code>|</code> operator to match multiple cases. This operator allows you to specify multiple patterns in a single <code>case</code>, and any of the patterns can be matched to trigger the execution of that branch.
For example, consider the following code:
<pre><code class="hljs">value = &quot;y&quot;

match value:
 case &quot;yes&quot; | &quot;y&quot;:
 print(&quot;The user confirmed&quot;)
 case _:
 print(&quot;The user denied&quot;)
</code></pre>
Here, if the value of <code>value</code> is equal to &quot;yes&quot; or &quot;y&quot;, the first branch of code will be executed. This is equivalent to the fall-through behavior in a traditional switch statement.
<h3 id="defaults">Defaults</h3>
As you've probably noticed from the above examples, the &quot;default&quot; case is handled using an underscore (<code>_</code>). This is considered the &quot;wildcard&quot; and matches all values. If one of the previous cases matches the value, then the default code branch is skipped over and not executed.
<h2 id="conclusion">Conclusion</h2>
As you can see, the Python match (aka &quot;switch&quot;) statement offers a powerful and convenient way to control the flow of your program. Whether you are new to Python or an experienced developer, the switch statement can help you write cleaner, more efficient code.

Guest Contributor

The Python Switch Statement

Scott Robinson

Dimitrije Stamenic

In this guide - learn the basics of testing in JavaScript with Mocha and Chai - focusing on Unit Testing and creating test suites, with practical code examples.

Testing Node.js Code with Mocha and Chai

In this in-depth guide, we will create a React app and cover a complete guide to how we can perform unit tests on the React application using _Jest_ and _React Testing Library_ so that you can hone your testing skills and learn how to create a tame React application.

Definitive Guide to Unit Testing in React Applications with Jest and React-Testing

<h2 id="introduction">Introduction</h2>
The security of users and their personal data while using a web application is paramount. While this guiding principle has been acknowledged even from the early stages of web development - bad actors find loopholes in applications, and may exploit your users.
<blockquote>
Many &quot;standard&quot; attacks are well-known and documented, and protection from them isn't hard. To unburden the developer from implementing security practices themselves, frameworks like Spring Boot have abstracted away various security measures and allow you to simply apply security filters in your applications to prevent well-known attacks.
</blockquote>
In this short guide, we'll take a look at what Cross-Site Scripting (XSS) is, how someone could perform this attack on your own application, and how you can prevent it easily with Spring Boot.
<h2 id="whatiscrosssitescriptingxss">What is Cross-Site Scripting (XSS)?</h2>
Cross-Site Scripting is a well-known, widely spread exploit, in which a bad actor injects a script into a web application.
Typically, a same-origin policy is applied to web applications, which restricts scripts in a web page to access data from sources if their origins don't match. Under the same-origin policy - if a page from a trusted website may access data interfacing with the user (such as cookies, for example), other pages from the same origin may do so as well. This form of access-control seemed sufficient to protect the integrity of data on web applications at the time.
Cross-Site Scripting circumvents the same-origin policy, by injecting a malicious script into a trusted website's page. Since the script is run from a trusted website, it's executed as a trusted script. There was no clear-cut way to differentiate between malicious scripts and non-malicious scripts - so arbitrary code execution was possible with Cross-Site Scripting. This ranges anywhere from inserting annoying alerts, to social engineering attacks, silently collecting user information, or redirecting users to phishing pages that appear to be parts of trusted websites.
Many websites are susceptible to Cross-Site Scripting attacks, and it remains a common attack today, even though this type of exploit has been known since the 90s.
<h2 id="preventingxssinaspringbootapplicationwithcontentsecuritypolicycsp">Preventing XSS in a Spring Boot Application with Content-Security Policy (CSP)</h2>
Spring Boot takes security seriously, and Spring's Security module implements flexible and powerful security practices that allows developers to minimize their worry when it comes to security, which oftentimes requires a low-level understanding of the principles of the way messages are being exchanged in a web application.
By default, Spring Boot implements several security headers:
<pre><code class="hljs">Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
</code></pre>
X-XSS-Protection is included by default! This security header attempts to detect XSS attempts, and blocks them. This isn't a fail-proof process though, and browsers have different implementations of detectors. Some browsers, like Chrome, have even removed their XSS Auditor. Additionally, the automated detection works for Reflected XSS Attacks, while other types of attacks also exist.
A more modern alternative to X-XSS-Protection is the Content-Security Policy (CSP), which primarily deal with policies on which resources can be loaded, from which origins, and at which endpoints. As of 2022, CSP is the best prevention measure against XSS, Clickjacking and other types of attacks. Not all browsers implement CSP, which is why it's not included in the security headers by default.

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 <div class="w-full">
 Note: Even with CSP in place, it's always the best course of action to validate any user input and make sure that it's safe to process using your system, to prevent code injection.

 </div>
 </div>
 </div>
 In Spring Boot - to configure custom web security measures, you'll typically extend the <code>WebSecurityConfigurerAdapter</code> class, and override the <code>configure()</code> method:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
 .headers()
 .contentSecurityPolicy(&quot;csp-directives&quot;);
 }
}
</code></pre>
Where the content security policy directives (supplied as a <code>;</code>-separated string) depend on your use-case and which sources you wish to trust:
<pre><code class="hljs">Content-Security Policy: directive1; directive2; directive3; ... directiveN;
</code></pre>
For example, a web application can list trusted websites from which scripts can be loaded with:
<pre><code class="hljs">script-src https://trusted.com;
</code></pre>
Or you can skip trusting any third-party website:
<pre><code class="hljs">script-src self;
</code></pre>
Similarly, an application can trust plugins:
<pre><code class="hljs">object-src https://trusted.com
</code></pre>
There's a wide variety of directives you can supply, including:
<ul>
<li><code>default-src</code> - Default fallback</li>
<li><code>child-src</code> - Valid web worker sources</li>
<li><code>frame-src</code> - Valid sources for <code>&lt;frame&gt;</code>s and <code>&lt;iframe&gt;</code>s</li>
<li><code>img-src</code> - Valid sources for images</li>
<li><code>media-src</code> - Valid sources for <code>&lt;audio&gt;</code>, <code>&lt;video&gt;</code> and <code>&lt;track&gt;</code> tags</li>
<li><code>script-src</code> - Valid script sources (helps prevent XSS)</li>
<li><code>style-src</code> - Valid sources for <code>&lt;style&gt;</code> elements</li>
<li><code>base-uri</code> - Restricts resources accessible from the <code>&lt;base&gt;</code> element</li>
<li><code>frame-ancestors</code> - Valid parents of <code>&lt;frame&gt;</code> <code>&lt;iframe&gt;</code>, <code>&lt;embed&gt;</code>, <code>&lt;applet&gt;</code>, etc. elements</li>
<li>etc.</li>
</ul>

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 <div class="w-full">
 Note: For the full list of accepted CSP directives, take a look at <a target="_blank" rel="nofollow noopener noreferrer" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy">MDN's Documentation</a>.

 </div>
 </div>
 </div>
 For example, here's a safe set of policy directives:
<pre><code class="hljs">script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:;
object-src &#x27;none&#x27;;
base-uri &#x27;none&#x27;;
require-trusted-types-for &#x27;script&#x27;;
report-uri https://csp.example.com;
</code></pre>
Let's add these to our Spring Boot application:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
 .headers()
 .contentSecurityPolicy(&quot;script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:; object-src &#x27;none&#x27;; base-uri &#x27;none&#x27;; require-trusted-types-for &#x27;script&#x27;; report-uri https://csp.example.com;&quot;);
 }
}
</code></pre>
You can use the <a rel="nofollow noopener noreferrer" target="_blank" href="https://csp-evaluator.withgoogle.com/">CSP-Evaluator</a> to evaluate whether your CSP directives are valid and safe, and it'll point out which directives are easily exploitable. Here's a CSP-directive that allows for Google APIs:
<pre><code class="hljs">default-src &#x27;self&#x27;;
object-src &#x27;none&#x27;;
frame-src &#x27;self&#x27; data:; 
script-src &#x27;self&#x27; &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; https://storage.googleapis.com; 
style-src &#x27;self&#x27; &#x27;unsafe-inline&#x27;; 
img-src &#x27;self&#x27; data:; 
font-src &#x27;self&#x27; data:;
base-uri &#x27;self&#x27;
</code></pre>
<h2 id="conclusion">Conclusion</h2>
In this short guide, we've taken a look at what Cross-Site Scripting (XSS) is, and how it works at a holistic level. Then, we've explored some XSS prevention measures that can easily be implemented with Spring Boot to make your applications safe, and set a Content-Security Policy (CSP).
Finally, we've explored CSP directives and took a look at a couple of different safe policies.

In this short guide, learn how to make your Java-based Spring Boot application safe against cross-site scripting (XSS) attacks, using CSP (Content-Safety Policy) and learn about CSP directives.

Prevent Cross-Site Scripting (XSS) in Spring Boot with Content-Security Policies (CSPs)

Cássia Sampaio

In this practical, hands-on, in-depth guide - learn everything you need to know about decision trees, ensembling them into random forests and going through an end-to-end mini project using Python and Scikit-Learn.

Definitive Guide to the Random Forest Algorithm with Python and Scikit-Learn

In this guide - learn how to check whether a string contains a digit, number, numeric representation or decimal using various methods, map(), any(), RegEx and lambda functions in Python, with performance benchmarks!