ESRI Advanced Guide To Python in GIS ch. 15: Warning in terminal

[JaredPilbeam2]

WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
* Running on http://127.0.0.1:5000

I was hoping to learn a way to share code through an app, as the chapter starts out by saying. But, once completing the chapter I see it's local. Am I missing something?

[CodyPatterson · Accepted solution]

Hey @JaredPilbeam2 

You're not necessarily missing anything, this is just a warning when I assume you're using Python Flask or something similar. All this really is telling you is that it is unsecure to use and run this server on your local machine, as it exposes your IP address and potentially other information. A production WSGI server can use Waitress which is what our company uses, or use a third party WSGI site that allows a more secure environment.

Our environment has a few Flask webhooks that run internally which all give this error when starting, it's a warning rather than an error and would not affect your ability to share or connect to others. The chapter more than likely wouldn't cover the addition of port bindings, DNS changes, or port forwarding so having it locally would still allow your coworker or friend to connect while on your local network. If you would like this to be available outside of your network, you would need a proxy or DNS change to make that happen!

Edit: Wanted to add that I believe 127.0.0.1 would only let it be viewable by you, but if you change the host to 0.0.0.0 then it would be accessible via your local IP through the network!

Cody

[JaredPilbeam2]

---

so having it locally would still allow your coworker or friend to connect while on your local network.

---

Thanks for the feedback! How would they connect? I tested by pasting that URL in a browser on a remote machine, but a connection couldn't be established. I'm confused as to how or what I'm supposed to share.

[CodyPatterson]

Hey @JaredPilbeam2 

So the usage of a Flask instance typically is to be ready for HTTP requests or some other request. Could you send over the code that you've implemented?

How I normally do it, is open a command prompt, type ipconfig, and press enter. You'll be given an IP address, for example: 192.168.1.25 or something similar. The user on the other end would connect to that IP over a port you've designated, and basically would need to send a request to "http://192.168.1.25:5000" when the user hits that endpoint with whichever request is configured, they'll be returned data or create something. If you'd like a further explanation I can definitely try!

Cody

[JaredPilbeam2]

Hi @CodyPatterson 

I attached the code straight from ch. 15. You just run the app.py file and it gives you the URL in the terminal.

The user on the other end would connect to that IP over a port you've designated, and basically would need to send a request

Thanks for explaining. I'm still learning when it comes to requests. I'm not grasping the above directions. 

[JaredPilbeam2]

@CodyPatterson 

Is this a good way to share it within network? The URL will work on a remote machine when testing. Or is it a security risk? 

if __name__ == "__main__":
    app.run(debug=True, port=5000, host='0.0.0.0')

EDIT: AH, I see you mentioned this method in your first reply. I didn't know what it meant at the time. But, I'm still wondering if this is a good idea as far as security goes.

[CodyPatterson]

Hey @JaredPilbeam2 

Sorry for the late reply! Looking at that code, it does appear that it's just an internal webhook for an endpoint host that allows you to generate tokens, and pull portal/online information.

In terms of security, this is an exclusively on-network Flask instance, so you wouldn't be able to reach the endpoint while outside of your company or personal network without port forwarding or some type of DNS mixture. In terms of in-network security, it's not insecure, because in order to actually access anything, you'd need to provide credentials to log into an environment before you're able to pull information. It is worth noting though that the credentials may be plain text to anyone sniffing around the network, but if in a work environment that risk is typically pretty low, but never zero of course!

If I were in your spot, I'd just try experimenting with it, have a coworker or colleague attempt to hit the endpoint using some type of HTTP request sender like Postman or another, definitely a good opportunity to learn how the webhooks work! Let me know if you have any questions, this is definitely my sort of realm so I would be glad to help!

Cody