2

I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site that I am running off of my laptop onto a port forward. When I run the server it says:

WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: off

I only plan to run this for a couple of hours, and it doesn't need to be particularly efficient, but I don't want to open my computer up to attack. (I know it's very dangerous to run it in debug mode like this). The web app doesn't have any sensitive data to be stolen, but I wanted to make sure I wasn't opening my machine to remote code execution, or anything like that.

2
  • 1
    If your presentation does not involve students connecting to the website, just serve it on localhost. May 26 '20 at 18:29
  • 1
    What is the use-case for this? Do you want potentially malicious actors to be able to connect to it? Or do you want to show a bunch of students something?
    – MechMK1
    May 26 '20 at 19:49
3

My understanding is Flask is not recommended for production because of stability rather than security. With WSGI or Gunicorn, you can utilize multi-thread/multi-proc more effectively, and serve multiple requests simultaneously.

If you're a beginner it can be daunting to go from Flask to WSGI (Gunicorn is slightly easier, but still has a learning curve). If this is just for a few hours to demo something to your class -- I'd say just go for exposing Flask, with the following caveats.

  1. Ensure the port you're exposing to the internet is sufficiently random (don't use 80 or 8080), try something like 48982, or 13892, etc -- this reduces your attack probability immensely :)
  2. Don't run flask as a root user, preferably create a scoped down user, that only has access to the files you wish to expose

Hope that helps.

1

The Development Server is perfectly suitable for a demo, with the following caveats:

  • You run with the defaults. The default makes the server available only to localhost (127.0.0.1). You would need to be explicit flask run --host=0.0.0.0 to make it available to the network. That may be fine if you want to demo over an internal network. But...
  • Don't make the Development server accessible over the public internet. The Development server is provided by Werkzeug for convenience, but is not designed to be particularly efficient, stable, or secure.

Sounds like you want other to access your application (otherwise you wouldn't port forward right?). If it's within an internal network, go for it. Otherwise don't.

I see the remote code execution worry that you have may be related to this vulnerability in the Werkzeug server when debugging is turned on. I'm sure you are wise enough to disable debugging when you do share your application.

Flask comes with some built in security protections like CSRF protection, but most security choices you need to take care of yourself (some security considerations) Input validation, secrets management, session management, security headers, HTTPS would be things to seriously consider before opening your application to the wider web. Otherwise you'd be inviting attacks like XSS, SQL injection, or worse.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.