search

itsthejoker / spiderweb

A small web framework, just big enough for a spider.
https://itsthejoker.github.io/spiderweb/
Other
47 stars 0 forks source link

Idea: HTTPS support #4

Open martinnedopil opened 11 hours ago

martinnedopil commented 11 hours ago

Hello.

I think, it will be possible to add HTTPS support. Yes, for production is better to use NGINX proxy or whatever else, but for testing purposes with self signed certificates, should be also nice to have this functionality.

My humble opinion is update LocalServerMixin:

def start(self, blocking=False): signal.signal(signal.SIGINT, self.signal_handler) self.log.info(f"Starting server on http://{self.addr}:{self.port}") self.log.info("Press CTRL+C to stop the server.") self._server = self.create_server() ----> just here when server is created and still not served_forever add following lines ----> self._server.socket = ssl.wrap_socket (app._server.socket, keyfile= path_to_key, certfile=path_to_cert, server_side=True)

...and of course add import ssl and new properties like ssl_enabled, path_to_key, path_to_cert ...

What is your opinion?

Martin

itsthejoker commented 8 hours ago

Hrm... I agree that it's possible, but can you elaborate on why that might be helpful? I know Django doesn't provide this functionality out of the box, and from a brief search, it looks like Flask might, but requires additional user-side setup. For this kind of work, I'd use ngrok to do a quick one-command proxy and get free HTTPS for testing rather than mucking with certs myself, but I'd like to hear your thoughts on it.

itsthejoker commented 8 hours ago

Mostly I'm concerned that adding this as an option would encourage people to use the dev server for more than it's meant for. It's inherently insecure and HTTPS would just be putting a lock on a cardboard box... making it look more secure than it is.