HTTPdis
A small synchronous HTTP dispatcher for Python services: named and regex routes, JSON/form payloads, responses, static files and Basic authentication. Used by dwho, Covenant and Auton. HTTPdis is a reference to the TARDIS in Doctor Who, matching the naming of Sonicprobe, dwho and Auton. This is independent software, not an official product.
When to use it
HTTPdis is useful for maintaining and extending services already built around its request handlers and lifecycle hooks. It uses the Python standard HTTP server and sonicprobe workers; it is not an ASGI server. For an unrelated new application, compare the maintenance cost of this custom stack with a maintained web framework.
Installation
python -m pip install httpdis
The declared range remains Python 2.7 and Python 3.5+. Legacy installations require
compatible dependency versions. On Python 3.13+, legacy-cgi and legacycrypt
replace removed standard-library APIs while preserving multipart and password-file
interfaces. Static MIME detection requires libmagic. See the CI matrix for actual
tested interpreters and the tests for the covered behaviors.
Minimal JSON service
from httpdis.ext import httpdis_json as server
def health(request):
return {'status': 'ok'}
server.register(health, 'GET', name='health')
options = {'listen_addr': '127.0.0.1', 'listen_port': 8080, 'max_workers': 2}
server.init(options)
server.run(options)
curl http://127.0.0.1:8080/health
Handlers receive a request with get_path(), query_params(), payload_params(),
get_headers() and get_server_vars(). They may return data or an HttpResponse
/ HttpResponseJson to control status and headers. register supports method
lists, compiled regular expressions and safe_init, at_start, at_stop hooks.
Routes and options are process-global; use a separate process for independent apps.
Authentication and deployment
Configure auth_basic_file with a trusted htpasswd file and auth_basic with the
realm. Set to_auth=True on protected routes, or use a username list such as
to_auth=['alice']. A protected route without configured authentication now returns
401 rather than allowing the request. Invalid credentials are rejected; request
credentials are isolated between threads. Existing {SHA} and system crypt hashes
remain readable for compatibility; legacy SHA-1/DES hashes are not recommendations
for new password storage. Basic credentials require HTTPS in transit.
Bind to loopback or a private interface behind a reverse proxy providing TLS,
request timeouts, connection limits and access controls. This release does not
claim complete HTTP parser hardening for hostile public traffic. Configure
max_body_size to limit request bodies. Chunked request bodies are not supported.
Internal exceptions are logged server-side and return a generic 500 to clients.
Static files
A static route uses static=True and root='/srv/public'. Regex routes can use
replacement to map URLs to filenames. Resolved symlinks outside the root are
rejected. Treat the static directory as administrator-controlled; these checks are
not a filesystem sandbox against concurrent hostile filesystem modifications.
Invalid If-Modified-Since values are ignored. Files are buffered in memory, so
serve large downloads through the reverse proxy.
Compatibility fixes
- Correct UTF-8 response byte lengths and duplicate Content-Type/Length headers.
- Correct Basic authentication on Python 3 and username-list registration.
- Keep credentials isolated across request threads and reject malformed headers.
- Reject missing authentication on protected routes and truncated request bodies.
- Resolve static paths before checking containment; tolerate invalid dates.
- Keep removed CGI/crypt functionality available through compatibility packages.
The dependency loop with sonicprobe is retained because sonicprobe's historical HTTP JSON module re-exports HTTPdis. A future major release should untangle it.
Development and publication
python -m pip install -e . mock
python -m unittest discover -s tests -v
python -m pip install build twine
python -m build
python -m twine check --strict dist/*
Update VERSION, RELEASE and setup.yml together. After tests and distribution
validation succeed, the master publication workflow creates vX.Y.Z and uploads
via Trusted Publishing (decryptus/httpdis, pypi.yml, environment pypi).
Already-tagged versions are not replaced by ordinary master commits.
License: GPL-3.0-or-later. Original authors and Wazo/Proformatique copyrights are preserved in the source files.
See the September 2026 code and architecture review (French).
1 maintainer
Metadata
1 maintainer
Release files for httpdis 0.6.27
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| httpdis-0.6.27.tar.gz | 32.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| httpdis-0.6.27-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details |
Total release size: 60.2 kB
Release files / httpdis-0.6.27.tar.gz
| Download URL | httpdis-0.6.27.tar.gz |
|---|---|
| Size | 32.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2dea449b8b119a0a33aeef5ee44b2504bb93e7e6c7b8ce29506032f491c70c5e
|
|
BLAKE2b-256 checksum How to use checksums |
c43b86b8df1472ea59a03db95e287a624e00450684c75bcceae775c096502862
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logRelease files / httpdis-0.6.27-py2.py3-none-any.whl
| Download URL | httpdis-0.6.27-py2.py3-none-any.whl |
|---|---|
| Size | 28.1 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
8151db62d3a81d53e29dd5667ae4c023af738cf7ed92d6a21c1e05597e417647
|
|
BLAKE2b-256 checksum How to use checksums |
ccdfa3277e69ba83ee89c1ef36f1da71fd2c62e7bd3ec7d9895684c818f53793
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency log
