2

A follow-up question to this one from 2012: https://unix.stackexchange.com/questions/32182/simple-command-line-http-server

Does anyone know a simple file webserver that is also secure? Many propose using http.server from Python, but docs explicitly state

Warning http.server is not recommended for production. It only implements basic security checks.

Basic Requirements:

  • should (only) be able to serve a directory
  • the focus should be on exposing the socket to the Internet without the worry of a take-over or similar events
  • docs should at least have a positive security note (in contrast to what Python stdlib says about its http.server)
7
  • related: security.stackexchange.com/questions/226095/… Commented Jan 6, 2021 at 14:57
  • Please be more specific about "serve a directory". Links? Authentication? Cookies?
    – waltinator
    Commented Jan 6, 2021 at 22:37
  • @waltinator You might need to inform yourself what "serving static files" in the context of HTTP servers means. The following docs can be helpful: Apache: httpd.apache.org/docs/2.4/urlmapping.html & NGINX: docs.nginx.com/nginx/admin-guide/web-server/… - Links/Authentication/Cookies don't play role (as in the question from 2012). Commented Jan 7, 2021 at 10:47
  • WSGI module for a simple file webserver is overkill, I suppose. Right now, I fix the situation using an nginx (but apache would work as well sure). I bothers me that people do not read the security note. :-/ I will think about security.stackexchange.com. Commented Jan 7, 2021 at 22:07
  • @peterh-ReinstateMonica Can you move the question over to security.stackexchange.com or should I copy/paste it there in its current form? Commented Jan 8, 2021 at 10:10

1 Answer 1

1

You could use WhiteNoise

Radically simplified static file serving for Python web apps

With a couple of lines of config WhiteNoise allows your web app to serve its own static files, making it a self-contained unit that can be deployed anywhere without relying on nginx, Amazon S3 or any other external service. (Especially useful on Heroku, OpenShift and other PaaS providers.)

It’s designed to work nicely with a CDN for high-traffic sites so you don’t have to sacrifice performance to benefit from simplicity.

WhiteNoise works with any WSGI-compatible app but has some special auto-configuration features for Django.

WhiteNoise takes care of best-practices for you, for instance:

Serving compressed content (gzip and Brotli formats, handling Accept-Encoding and Vary headers correctly)

Setting far-future cache headers on content which won’t change

Worried that serving static files with Python is horribly inefficient? Still think you should be using Amazon S3? Have a look at the Infrequently Asked Questions below.

I use it in my Django projects.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.