Is the server bundled with Flask safe to use in production?

by

No. The bundled server is a development server. It’s not designed with production environments in mind.

  • It will not handle more than one request at a time by default.
  • If you leave debug mode on and an error pops up, it opens up a shell that allows for arbitrary code to be executed on your server (think os.system('rm -rf /')).
  • The development server doesn’t scale well.

Flask uses Werkzeug’s development server, and the documentation says the same thing:

The development server is not intended to be used on production systems. It was designed especially for development purposes and performs poorly under high load. For deployment setups have a look at the Application Deployment pages.

The recommended approach is to use a production WSGI server to run your Flask application. There’s a whole section dedicated to deployment in the docs: Deployment Options.

Deploying your application is as simple as installing a WSGI server like uWSGI or gunicorn and running that instead of Flask’s development server:

gunicorn -w 4 -b 127.0.0.1:4000 myproject:app

If you are serving any static assets like images or videos, need low-level caching, or have higher concurrency demands, it’s recommended to use a webserver like nginx and have it handle all of your requests.

In crappy ASCII form:

                +----------+
                | Client 2 |
                +----------+
                      |
                      V 
+----------+      +-------+      +----------+
| Client 1 |----->| nginx |<-----| Client 3 |
+----------+      +-------+      +----------+
                      ^
                      |
                      V
           /--------------------\
           | useful nginx stuff |
           | like asset serving |
           | and rate limiting  |
           \--------------------/
                      |
                      V
               +-------------+
               | WSGI server |
               +-------------+

To actually run the WSGI server process, you can use Supervisor. It automatically restarts the server if it fails for some reason, keeps logs, and runs as a daemon so your service starts when the server boots.

More Related Contents:

  1. Get the data received in a Flask request
  2. Configure Flask dev server to be visible across the network
  3. Get IP address of visitors using Flask for Python
  4. Get raw POST body in Python Flask regardless of Content-Type header
  5. Capture arbitrary path in Flask route
  6. RuntimeError: working outside of application context
  7. Flask url_for generating http URL instead of https
  8. X-Forwarded-Proto and Flask
  9. Handling large file uploads with Flask
  10. Flask app that routes based on subdomain
  11. Why is sudo not accepting my sudo password? [closed]
  12. Refering to a directory in a Flask app doesn’t work unless the path is absolute
  13. Post values from an HTML form and access them in a Flask view
  14. Can Flask have optional URL parameters?
  15. Return JSON response from Flask view
  16. Why not generate the secret key every time Flask starts?
  17. Flask-Login raises TypeError: ‘bool’ object is not callable when trying to override is_active property
  18. Importing flask.ext raises ModuleNotFoundError
  19. Flask ImportError: No Module Named Flask
  20. How to build a flask application around an already existing database?
  21. How to get http headers in flask?
  22. Flask-SQLAlchemy db.create_all() raises RuntimeError working outside of application context
  23. AttributeError: ‘int’ object has no attribute ‘_sa_instance_state’
  24. Where does flask look for image files?
  25. How to show a pandas dataframe into a existing flask html table?
  26. How to send requests with JSON in unit tests
  27. ValueError: Shape of passed values is (1, 6), indices imply (6, 6)
  28. Flask css not updating [closed]
  29. flask socketio emit to specific user
  30. Static files in Flask – robot.txt, sitemap.xml (mod_wsgi)

Leave a Comment