4 ms·

I'm doing my first web project (self-taught), which is the prototype for an offering me and a partner are developing to become a startup. I was about to start d

I'm doing my first web project (self-taught), which is the prototype for an offering me and a partner are developing to become a startup. I was about to start deployment (for the first time in my life) this week, but now I'm afraid. It's a flask app. We serve users forms (POST), then I use this input to run calculations on the server through a python script which makes queries to a MySQL db, then I return results to browser my listing a result-array dynamically using a Jinja template. Is this unsecure? Any tip or accessible reading material to help me understand this matter? We don't store credit card info or other sensitive information for now, because we didn't reach any clients yet, but final version should have at least login functionality. Any light/knowledge/consideration will be much appreciated! PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this.

kazagistar 6y ago
It sounds like you are probably fine. Your python flask script is the API layer. Just make sure it can only run sql that you want it to run (ideally, read only until you get it authenticated), and that it escapes user input, and that no one except admins have access to the actual db underneath, and you are totally fine. Also, for that matter, its a good idea to run backups too, just in case something goes wrong and you need to restore. This is literally people allowing users to run arbitrary commands on their fully exposed db, and then being surprised when someone runs a delete.
dylan604 6y ago
>PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this Don't allow access to `mysql -h hostname` from WWW. Instead, keep your MySQL server accessible only by machines you control in the same security group/network/etc. To get access to the database from the public, create an API that allows predefined queries only to users you've authorized. This API would also be hosted within the same security group/network/etc. The public never gets direct access to the database, yet gets the predefined access they need.
jeroenhd 6y ago
Your API, in this case, is basically your Flask application so you're pretty much done. If you want to run a database securely, you configure a decent password (should be asked during installation), create new users for each application/database (easy with tools like MySQL workbench) and make all applications running on the server (Flask, in this instance) connect to localhost/127.0.0.1. Don't expose services like databases to the outside world if you cannot in any way help it. Then enable a firewall on your server (Ubuntu server comes with UFW by default) and lastly use a port scanning tool like nmap/zenmap to check if you have left any services other than HTTP(S) exposed. I don't know much myself about Flask deployments specifically, but you'll probably use something like nginx or Apache to handle the actual web requests. There's an article here [0] on how to do that. After you've done that, you can secure your connections for free through Let's Encrypt clients like certbot [1] which handle most of the configuration for you. TL;DR: 1. Configure your application to connect to localhost with a secure password 2. Enable a firewall, run "nmap <your domain>" to check if it works (should only expose HTTP(S) and probably SSH if you did it right). 3. Install nginx or Apache to handle requests for you and follow the guide at [1] [0] https://www.digitalocean.com/community/tutorials/how-to-deploy-a-flask-application-on-an-ubuntu-vps https://www.digitalocean.com/community/tutorials/how-to-depl... [1] https://certbot.eff.org/instructions https://certbot.eff.org/instructions

kazagistar 6y ago

It sounds like you are probably fine. Your python flask script is the API layer. Just make sure it can only run sql that you want it to run (ideally, read only until you get it authenticated), and that it escapes user input, and that no one except admins have access to the actual db underneath, and you are totally fine. Also, for that matter, its a good idea to run backups too, just in case something goes wrong and you need to restore. This is literally people allowing users to run arbitrary commands on their fully exposed db, and then being surprised when someone runs a delete.

dylan604 6y ago

>PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this Don't allow access to `mysql -h hostname` from WWW. Instead, keep your MySQL server accessible only by machines you control in the same security group/network/etc. To get access to the database from the public, create an API that allows predefined queries only to users you've authorized. This API would also be hosted within the same security group/network/etc. The public never gets direct access to the database, yet gets the predefined access they need.

jeroenhd 6y ago

Your API, in this case, is basically your Flask application so you're pretty much done. If you want to run a database securely, you configure a decent password (should be asked during installation), create new users for each application/database (easy with tools like MySQL workbench) and make all applications running on the server (Flask, in this instance) connect to localhost/127.0.0.1. Don't expose services like databases to the outside world if you cannot in any way help it. Then enable a firewall on your server (Ubuntu server comes with UFW by default) and lastly use a port scanning tool like nmap/zenmap to check if you have left any services other than HTTP(S) exposed. I don't know much myself about Flask deployments specifically, but you'll probably use something like nginx or Apache to handle the actual web requests. There's an article here [0] on how to do that. After you've done that, you can secure your connections for free through Let's Encrypt clients like certbot [1] which handle most of the configuration for you. TL;DR: 1. Configure your application to connect to localhost with a secure password 2. Enable a firewall, run "nmap <your domain>" to check if it works (should only expose HTTP(S) and probably SSH if you did it right). 3. Install nginx or Apache to handle requests for you and follow the guide at [1] [0] https://www.digitalocean.com/community/tutorials/how-to-deploy-a-flask-application-on-an-ubuntu-vps https://www.digitalocean.com/community/tutorials/how-to-depl... [1] https://certbot.eff.org/instructions https://certbot.eff.org/instructions