CODEWITHSUNDEEP
pythonflaskhttpsgunicorn
Cnoor0171
Cnoor0171

Reputation: 374

flask server with ssl_context freezes if it receives http request

I'm trying to create a simple flask server that redirects any http requests to https. I've created a certificate and key file and registered a before_request hook to see if the request is secure and redirect appropriately, following advise this SO answer.

The flask server responds to https requests as expected. However, when I send an http request, the before_request hook never gets called and ther server hangs forever. If I send the http request from the browser, I see an "ERR_EMPTY_RESPONSE". The server doesn't even respond to https requests afterwards. No logs are printed either.

Running the app with gunicorn didn't help either. The only difference was that gunicorn is able to detect that the worker is frozen and eventually kills and replaces it. I've also tried using flask-talisman, with the same results.

Below is the code I'm running

### server.py
from flask import Flask, request, redirect


def verify_https():
    if not request.is_secure:
        url = request.url.replace("http://", "https://", 1)
        return redirect(url, 301)


def create_flask_app():
    app = Flask(__name__)
    app.before_request(verify_https)
    app.add_url_rule('/', 'root', lambda: "Hello World")
    return app


if __name__ == '__main__':
    app = create_flask_app()
    app.run(
        host="0.0.0.0",
        port=5000,
        ssl_context=('server.crt', 'server.key')
    )

Running it with either python3.8 server.py or gunicorn --keyfile 'server.key' --certfile 'server.crt' --bind '0.0.0.0:5000' 'server:create_flask_app()' and opening a browser window to localhost:5000 causes the server to hang.

Upvotes: 8

Views: 1483

Answers (2)

mrAndrew
mrAndrew

Reputation: 586

Talking about freezes, its not. Flask and gunicorn can serve only one variant of connection. So it's not freezing because your browser canceled the request and is idling.

I think it is better to use a faster web server, for example, Nginx, if you want to change HTTP to HTTPS. I would recommend it to you.

But it's possible to trigger your verify_https function if you run multiple instances of gunicorn at the same time.
I took your example, generated a certificate, and then run this script in my console (it contains a background job and can be runned in twoo separate ter)

gunicorn --bind '0.0.0.0:80' 'server:create_flask_app()' & gunicorn --certfile server.crt --keyfile server.key --bind '0.0.0.0:443' 'server:create_flask_app()'

now chrome goes to the secure page as expected.

Upvotes: 3

CSEngiNerd
CSEngiNerd

Reputation: 319

Typically servers don't listen for both http and https on the same port. I have a similar requirement for my personal portfolio, but I use nginx to forward http requests (port 80) to https (port 443) and then the https server passes it off to my uwsgi backend, which listens on port 3031. That's probably more complex than you need, but a possible solution. If you go that route I would recommend letsencrypt for your certificate needs. It will set up the certificates AND the nginx.conf for you.

If you don't want to go the full nginx/apache route I think your easiest solution is the one suggested here on that same thread that you linked.

Upvotes: 1

Related Questions