1

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API secured using https with a self-signed certificate. For this reason (because serving Flask with waitress does not support https on its own), I am using nginx on the same machine as a proxy so that it can handle https.

My question is: If someone connects to my network, let's say via wifi, and runs a packet sniffer like Wireshark, will they be able to see what is being transferred between the legitimate clients of the app and the app?

When running Wireshark on the same machine as the application, I see the request and all of its contents. I believe this is because it is sniffing on localhost and sees the forwarded http request (from nginx to the app). When running Wireshark on my laptop, I don't see the http request. Can someone confirm this is safe for my purposes?

Also: Can someone confirm that if nginx were to run on a separate local machine, then the http request would be exposed again?

EDIT: Here is the nginx configuration I have

server {
    listen 443 ssl;

    ssl_certificate /etc/nginx/sites-available/nginx-selfsigned.crt;
    ssl_certificate_key /etc/nginx/sites-available/nginx-selfsigned.key;

    server_name example.com;

    location / {

        proxy_pass http://127.0.0.1:5000;
        proxy_set_header X-Real-IP $remote_addr;


    }
}

server {
  listen 80;

  server_name 192.168.1.5;

  return 301 https://$server_name$request_uri;
}
3

If installed on localhost with sufficient permissions, Wireshark can see all your localhost traffic (with some caveats).

That said, a 'packet sniffer' in my understanding refers to something running on a different machine which sniffs packets off the actual network. It's my (perhaps not entirely correct) understanding that packets to/from localhost from/to localhost or to/from 127.0.0.1 from/to 127.0.0.1 do not end up on the network. You may want to read a bit about the loopback interface.

6
  • hi thanks for the answer. however, if the machine on which the sensitive unencrypted communication is mine and no one else has access to it, then I should be safe, do I understand correctly? – Theo Stefou Apr 17 at 19:12
  • @TheoStefou to be honest, I'm not 100% certain, but I think that localhost and 127.0.0.1 traffic will not appear on the network, but it may depend on various details of your computer's configuration or operating system. That is why I provided a link to some reading about the loopback interface. – S. Imp Apr 18 at 1:18
  • 1
    It is indeed safe to assume that traffic to/from localhost/127.0.0.1 can only be seen from the machine itself. Whether or not you are safe is another question entirely – Conor Mancone Apr 18 at 2:20
  • @ConorMancone what do you mean if I am safe? Do you mean regarding other safety factors besides https? Or is there still some issue with this? – Theo Stefou Apr 18 at 12:18
  • @TheoStefou "safe" is a meaningless word in the security world. There is only "safe enough for my purposes". You do not have to worry about packet sniffing local traffic from the network. You are safe from this particular threat, but the list of threats is endless :) – Conor Mancone Apr 18 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.