Lesson 4.1 · Configuration and data· 2 min read
Configuration, serialization, and encoding
Separate configuration from behavior and distinguish an encoding transformation from confidentiality or authenticity.
- Platform:
- Cross-platform
- Language:
- Python
- Difficulty:
- Intermediate
What you will learn
Separate configuration from behavior and distinguish an encoding transformation from confidentiality or authenticity.
Before you begin: APIs and security context; basic Python dictionaries.
Configuration is an input to behavior
Two builds can share implementation code while using different settings. A configuration record might influence feature selection, identifiers, or limits. To explain its role, identify where a value is read, how it is validated, and which behavior depends on it. The presence of a setting does not prove the corresponding branch executes.
This lesson uses a deliberately small JSON document that selects a printed demonstration label. The program neither contacts an endpoint nor changes the host. Its purpose is to expose the boundary between serialized text, parsed data, and a permitted choice.
Read, validate, then interpret
import json
raw = '{"version": 1, "label": "demo"}'
config = json.loads(raw)
if not isinstance(config, dict):
raise ValueError("configuration must be an object")
if type(config.get("version")) is not int or config["version"] != 1:
raise ValueError("unsupported version")
if config.get("label") not in ("demo", "exercise"):
raise ValueError("unknown label")
print(config["label"]) # demo
The JSON parser establishes that the input can be decoded as JSON. The following checks establish a much narrower contract. Valid JSON can still be the wrong shape, have an unsupported version, or name an unknown option. Notice the distinction between structural validity and acceptance by this particular implementation.
Encoding is not a security guarantee
Serialization represents a structure as bytes or text. Encoding changes a representation. Compression reduces redundancy in suitable inputs. Encryption is a different claim involving a cryptographic design and keys. Do not call an unfamiliar string “encrypted” merely because it is unreadable at a glance.
Similarly, decoding a value says nothing by itself about who produced it or whether it was modified. When discussing a source excerpt, describe the transformation you can establish. If authenticity is relevant, look for evidence of a verification step and its failure handling rather than assuming one exists.
Follow configuration consumers
A parsed value can be copied, defaulted, overwritten, or never read. Trace the consumer before connecting a setting to an effect. In this example, the only consumer prints the label. An allowed value does not activate additional behavior simply because a reader imagines it might.
Exercise
Replace the document with [], then with an object whose version is true, then with a label of other. Predict where each fails. Why is a successful call to json.loads insufficient?
Check your understanding
The list fails the object check, the Boolean fails the exact integer check, and the unknown label fails the permitted-values check. Parsing only establishes a representation; the application defines which represented values it accepts.