Sockets in Python: TCP Server

By the end of this lesson you can:

• Build a TCP server: bind → listen → accept → handle → close.
• Serve multiple clients concurrently with threads.
• Apply server security defaults: bind to localhost, validate input, cap resources.
• Pair it with the Lesson 7 client over your length-prefixed protocol.

Last lesson's client initiated connections. A server does the opposite: it claims a port, then waits. When a client connects, the server gets a fresh socket dedicated to that one client, talks to it, and goes back to waiting for the next.

A minimal echo server

import socket

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)  # reuse port on restart
    server.bind(("127.0.0.1", 9000))      # claim host:port — LOCALHOST
    server.listen()                        # start accepting
    print("listening on 127.0.0.1:9000")

    while True:
        conn, addr = server.accept()       # blocks until a client connects
        with conn:
            print("client:", addr)
            data = conn.recv(1024)
            conn.sendall(data)             # echo it back

• bind((host, port)) claims the address. Bind to 127.0.0.1 so only your machine can reach it (not 0.0.0.0, which exposes it to the whole network).
• listen() turns the socket into a listening server.
• accept() blocks and returns (conn, addr) — a new socket just for that client, plus their address.
• SO_REUSEADDR avoids "address already in use" when you restart during development.

Serving many clients with threads

The minimal server handles one client at a time (a second client waits). Hand each connection to a thread to serve them concurrently:

import socket, threading

def handle_client(conn, addr):
    with conn:
        conn.settimeout(30)                # don't let a client tie up a thread forever
        while True:
            data = conn.recv(1024)
            if not data:                   # client disconnected
                break
            conn.sendall(data)             # echo
    print("closed:", addr)

def serve():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
        server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        server.bind(("127.0.0.1", 9000))
        server.listen()
        while True:
            conn, addr = server.accept()
            # one thread per client (daemon = dies when main exits)
            threading.Thread(target=handle_client, args=(conn, addr),
                             daemon=True).start()

Server security defaults — the must-dos

For real apps, prefer a framework

Raw sockets are perfect for understanding the network and for security tooling. For production services you'd use a framework (Flask, FastAPI, asyncio) that handles concurrency, parsing, and many security details for you. Knowing sockets makes you a better user of those frameworks.

Goal: a threaded server speaking the length-prefixed protocol from Lesson 7, with every security default baked in — size caps, timeouts, validation, logging. This is the foundation for the encrypted chat in Lesson 10.

import socket, struct, threading, logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(message)s",
                    datefmt="%H:%M:%S")
log = logging.getLogger("server")

HOST, PORT = "127.0.0.1", 9000        # localhost only
MAX_MSG = 64 * 1024                    # 64KB cap — refuse anything larger

def recv_exact(sock, n: int) -> bytes:
    buf = b""
    while len(buf) < n:
        chunk = sock.recv(n - len(buf))
        if not chunk:
            raise ConnectionError("client closed")
        buf += chunk
    return buf

def recv_msg(sock) -> str:
    (length,) = struct.unpack("!I", recv_exact(sock, 4))
    if length > MAX_MSG:               # validate size BEFORE reading
        raise ValueError(f"message too large: {length} bytes")
    return recv_exact(sock, length).decode("utf-8", errors="replace")

def send_msg(sock, text: str) -> None:
    data = text.encode("utf-8")
    sock.sendall(struct.pack("!I", len(data)) + data)

def handle(conn, addr):
    log.info("connect %s", addr)
    with conn:
        conn.settimeout(60)            # idle clients get dropped
        try:
            while True:
                msg = recv_msg(conn)
                msg = msg.strip()[:500]        # validate/limit before use
                log.info("%s says: %r", addr, msg)
                if msg.lower() == "quit":
                    send_msg(conn, "bye"); break
                send_msg(conn, f"echo: {msg}")  # NEVER eval/exec the input
        except (ConnectionError, ValueError, socket.timeout) as e:
            log.warning("%s dropped: %s", addr, e)
    log.info("closed %s", addr)

def main():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
        server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        server.bind((HOST, PORT))
        server.listen()
        log.info("listening on %s:%d (localhost only)", HOST, PORT)
        while True:
            conn, addr = server.accept()
            threading.Thread(target=handle, args=(conn, addr),
                             daemon=True).start()

if __name__ == "__main__":
    main()

14:30:00 listening on 127.0.0.1:9000 (localhost only)
14:30:05 connect ('127.0.0.1', 51422)
14:30:05 ('127.0.0.1', 51422) says: 'hello'
14:30:08 ('127.0.0.1', 51422) says: 'quit'
14:30:08 closed ('127.0.0.1', 51422)

Read the code

Every security default from the concept section is here: bound to 127.0.0.1, a 64KB size cap validated before reading (so a malicious 4GB length can't exhaust memory), a 60-second idle timeout (so a stalled client can't hold a thread), input stripped/truncated before use, and the echo handler never evals or shells out the input. The threading lets many clients connect at once. Pair it with the Lesson 7 client's send_msg/recv_msg and you have a complete, safe message system — ready for TLS in Lesson 9.

A TCP server runs create → bind → listen → accept (loop) → handle → close; accept gives a per-client socket you hand to a thread for concurrency. Because a server accepts input from anyone who can reach it, security defaults are non-negotiable: bind to localhost in dev, set timeouts, cap message size before reading, validate all input, and never eval/exec or shell out client data. Add a concurrency cap to resist slow-client DoS. Raw sockets teach the fundamentals; production services use frameworks built on these same ideas — now with TLS next lesson.