#!/usr/bin/env python3
"""Serve the Document-PiP origin-spoof POC.

For a real demonstration the page must be served over HTTPS from a hostname
whose left-hand prefix impersonates the target, e.g.
    accounts.google.com.x.<attacker-etld+1>
because the Android PiP header displays the *opener* host left-anchored with
tail elision.

For local smoke-testing of the JS only (no spoof effect), this serves on
http://localhost:8080/poc.html.
"""
import http.server
import os
import socketserver

PORT = 8080

class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *a, **kw):
        super().__init__(*a, directory=os.path.dirname(os.path.abspath(__file__)), **kw)

    def end_headers(self):
        self.send_header("Cache-Control", "no-store")
        super().end_headers()

if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("", PORT), Handler) as httpd:
        print(f"Serving POC on http://localhost:{PORT}/poc.html")
        httpd.serve_forever()