3

My understanding is Flask is not recommended for production because of stability rather than security. With WSGI or Gunicorn, you can utilize multi-thread/multi-proc more effectively, and serve multiple requests simultaneously. If you're a beginner it can be daunting to go from Flask to WSGI (Gunicorn is slightly easier, but still has a learning curve). If ...


2

When you say, tunneling traffic using 6tunnel, you are considering security in transit while when you mentioned use of virtual server, you are considering seclusion of private system and server so private data is considered safe.The hardware to serve both remains the same. The risk you are not considering is comprise of web app/site and the moment control ...


1

I read that uuid does not bring any security advantages This entirely relative to a given context. So it's neither true or false. Consider that right now the session id is encrypting the auto-increment id (no uuid is used). If someone manages to know how the session is encrypted, then he can impersonate all the users: encrypt "1" and set the value as ...


1

The Development Server is perfectly suitable for a demo, with the following caveats: You run with the defaults. The default makes the server available only to localhost (127.0.0.1). You would need to be explicit flask run --host=0.0.0.0 to make it available to the network. That may be fine if you want to demo over an internal network. But... Don't make the ...


1

It is important to understand exactly what the requirements are and how they can be met, as in what is an acceptable solution to both parties. As everybody always says, security is about compromises. You can have the pvt keys encrypted and nginx will ask for the password every time it starts. This is OK security wise, but not practical at all; You can have ...


Only top voted, non community-wiki answers of a minimum length are eligible