I bought a domain, let's say its "mydomain.org".
I connected that domain to Cloudflare and Heroku, and I can access my web app(site) on mydomain.org, handle the flask's route('/') requests.
But when I use, for example, route('/', subdomain="test") and try to return "This is a subdomain", it does nothing, or if it does, it redirects me to the simple route('/') (so basically without the subdomain).
I registered a subdomain on Heroku and created an alias for test.mydomain.org to point to the DNS that Heroku gave me, but I still get redirected to the main page, instead of getting simply the "This is a subdomain" message.
How could I make it work?
Related
I have the project successfully deployed through AWS. However, I would like to make some changes and experiment on them using localhost:8000/ first before making the changes to AWS server. I set my settings.py to: ALLOWED_HOSTS = ['IP address', 'www.website.com'] to deploy it. Though, I also want to be able to run the server in my local computer so I can experiment it before showing to public. The url is (r^homepage$') When I go to localhost:8000/homepage, it gives a Bad Request (400). I tried many permutations of the urls but nothing works.
you can set Debug=True to see the error message.
I'm trying to create a Slack App (see here), but I'm having incredible difficulty with how to create a Redirect URI.
Slack states the following:
You must specify at least one redirect URL for OAuth to work. If you
pass a URL in an OAuth request, it must (at least partially) match one
of the URLs you enter here. Learn more
I have a rudimentary understanding of a Redirect URI conceptually, but I have no idea how to go about actually getting this Redirect URI that Slack requires.
I've successfully used all of Slacks Integrations with Python including Real Time Messaging, but setting up a Redirect URI seems to require a special server or a website.
As already mentioned in the comments you will need a publicly reachable webserver to host your script for installing the Slack app. So the redirect URL is the URL to your installation script.
Basically any webserver or script hosting service that runs your favorite script flavor (e.g. PHP or Python) will work. See also this answer on how the OAUTH process can be implemented.
The redirect URL works without SSL, but for security reasons SSL is strongly recommended. Also many other features of Slack requires you to run SSL on your webserver (e.g. Interactive Buttons)
Another option is to run a webserver on your local machine (e.g. WAMP for windows) and open it to the Internet through a secure tunnel (e.g. ngrok). For developing and testing this is actually the better alternative, since you can test and fix your Slack app locally without having to deploy every change on a public server.
However for running a public Slack app (e.g. one that is listed on the Slack App Directory) I would strongly recommend to put the production version of your App on a public webserver.
If you're just trying to get it up so that you can authorize another workspace you can always use 'http://localhost' after authorizing it will try to redirect you there and you wont be able to see anything useful, but the authorization should still have taken place I believe.
of course if you're looking for the api code, you will have to pull it directly from the browser url. ... it's very manual.
The question explains mostly everything. I am writing a Django app which will use Facebook authentication through Python social auth. I created an app using Facebook developers. The thing is, I don't have the domain set up with my website as I am still testing on localhost. I could not put in the localhost URL in the Facebook app settings. When I try to login through localhost, it says the URL must match with the domain.
What to do now? Without testing, I cannot host my website either as I am not sure if everything will work like i want it to.
EDIT:
I created a test app and was able to put localhost:8000 as the site url and localhost as app domain. However, the same problem still exists. It says that the 2 urls has to match or something. NOTE: In my local host, the login is 127.0.0.1:8000/login/facebook. And yes, I did update the ID and the app secret for my test app.
What to do now?
You should be able to create a test app within Facebook (There is a 'Create Test App') menu option. It may be that you need to first create an App, and once you have it, you will be able to create the Test App for it, but for sure you can create a Test App.
On that test app, use http://localhost:8000/ as your local URL. Just make sure it is the exact same URL (i.e. you cannot have 'localhost' on Facebook, but then start the server for '127.0.0.1'). Note that the AppID and AppSecret you will use is of the Test App (not the production app).
This should work. I have not used this for python-social-auth but use this to test with django-allauth, and there is no reason why it will be any different.
I'm using the awesome Flask framework to create a website in which I use Flask-login for my user logins. This normally works fine, but sometimes I see strange issues with logins being mixed. We've got 3 flask dev-servers running on one machine (on different ports) and we're working in an office with about 10 people (with one shared ip). The problem is that sometimes one user is suddenly logged in as another user.
I can't really pinpoint when or under which circumstances this happens. But I also don't really know how I can debug it. Could the source of the evil be that we share an internet connection or is the problem that we run several flask dev-servers on one machine?
I don't know whether this also happens with people outside of our office (we're still in testing phase).
Can anybody give me some tips on how I can debug this?
Most likely you are using a web server which is caching (some of ) HTTP replies from Flask. These could include static media, generated media, PDFs, Office files.
A misconfigured front end web server may cache such a HTTP response containing media and the session cookie (Cookies header). After happily caching this response then the front end web server serves it to another user. The existing session cookie of this user gets overwritten with the session cookie from the cached HTTP response. Then, due to session switch, the user becomes the user whose HTTP response was cached.
Solutions
Fix your session middleware
Explicitly set no caching headers on the server side
Configure your front end web server not to cache responses with cookies
Further information in operationssecurity.org.
Originally, I tried to post an ajax request from my client side to a third party url, but it seems that the browser have security issues with that. I thought about sending an ajax to the server side, from there to send a GET request to the third party, get the response and send it back to the client side. How can I do that with flask?
Install the requests module (much nicer than using urllib2) and then define a route which makes the necessary request - something like:
import requests
from flask import Flask
app = Flask(__name__)
#app.route('/some-url')
def get_data():
return requests.get('http://example.com').content
Depending on your set up though, it'd be better to configure your webserver to reverse proxy to the target site under a certain URL.
Flask alone does not have this capability, but it is a simple matter to write a request handler that makes a request to another server using an HTTP client library and then return that response.
# third-party HTTP client library
import requests
# assume that "app" below is your flask app, and that
# "Response" is imported from flask.
#app.route("/proxy-example")
def proxy_example():
r = requests.get("http://example.com/other-endpoint")
return Response(
r.text,
status=r.status_code,
content_type=r.headers['content-type'],
)
However, this will not achieve exactly the same result as you might expect from a client-side request. Since your server cannot "see" any cookies that the client browser has stored for the target site, your proxied request will be effectively anonymous and so, depending on the target site, may fail or give you a different response than you'd get requesting that resource in the browser.
If you have a relationship with the third-party URL (that is, if you control it or are able to work with the people who do) they can give access for cross-domain requests in the browser using CORS (which is only supported in modern browsers) or JSON-P (an older workaround that predates CORS).
The third-party provider could also give you access to the data you want at an endpoint that is designed to accept requests from other servers and that provides a mechanism for you to authenticate your app. The most popular protocol for this is OAuth.
As the other answers have stated using the requests module for python would be the best way to tackle this from the coding perspective. However as the comments mentioned (and the reason I came to this question) this can give an error that the request was denied. This error is likely cause by SELinux.
To check if this is the issue first make sure SELinux is enabled with this command:
sestatus
If 'Current Mode' is 'enforcing' then SELinux is enabled.
Next get the current bool values that apply directly to apache with this command:
getsebool -a | grep httpd
Look for the setting 'httpd_can_network_connect' this determines if apache is allowed to make TCP requests out to the network. If it is on then all apache TCP requests will be allowed. To turn it on run the following as root:
setsebool -P httpd_can_network_connect 1
If you only need database access (I had this problem before which is why I suspected SELinux here) then it would probably be better to only turn on 'httpd_cna_network_connect'.
The purpose of this policy is that if a hacker was to hijack your apache server they would not be able to get out through the server to the rest of your internal network.
This probably would've been better as a comment but I don't have enough rep..
Sources:
https://tag1consulting.com/blog/stop-disabling-selinux
https://wiki.centos.org/TipsAndTricks/SelinuxBooleans