Mixing
Is the default django development server secure or can others access it?
I'm new to django/python and want to make sure that if I'm learning django on my own from my work machine, it won't be some kind of security breech when django sets up its automatic development server. I'm using this tutorial: https://docs.djangoproject.com/en/2.1/intro/tutorial01/
And they have you set up the dev server as:
$ python manage.py runserver
which outputs:
Performing system checks...
System check identified no issues (0 silenced).
You have unapplied migrations; your app may not work properly until they are applied.
Run 'python manage.py migrate' to apply them.
November 17, 2018 - 15:50:53
Django version 2.1, using settings 'mysite.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
Can others access this server, either from within the network or just through the internet? How would one go about checking that?
python django security server
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
add a comment |
I'm new to django/python and want to make sure that if I'm learning django on my own from my work machine, it won't be some kind of security breech when django sets up its automatic development server. I'm using this tutorial: https://docs.djangoproject.com/en/2.1/intro/tutorial01/
And they have you set up the dev server as:
$ python manage.py runserver
which outputs:
Performing system checks...
System check identified no issues (0 silenced).
You have unapplied migrations; your app may not work properly until they are applied.
Run 'python manage.py migrate' to apply them.
November 17, 2018 - 15:50:53
Django version 2.1, using settings 'mysite.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
Can others access this server, either from within the network or just through the internet? How would one go about checking that?
python django security server
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
add a comment |
I'm new to django/python and want to make sure that if I'm learning django on my own from my work machine, it won't be some kind of security breech when django sets up its automatic development server. I'm using this tutorial: https://docs.djangoproject.com/en/2.1/intro/tutorial01/
And they have you set up the dev server as:
$ python manage.py runserver
which outputs:
Performing system checks...
System check identified no issues (0 silenced).
You have unapplied migrations; your app may not work properly until they are applied.
Run 'python manage.py migrate' to apply them.
November 17, 2018 - 15:50:53
Django version 2.1, using settings 'mysite.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
Can others access this server, either from within the network or just through the internet? How would one go about checking that?
python django security server
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
I'm new to django/python and want to make sure that if I'm learning django on my own from my work machine, it won't be some kind of security breech when django sets up its automatic development server. I'm using this tutorial: https://docs.djangoproject.com/en/2.1/intro/tutorial01/
And they have you set up the dev server as:
$ python manage.py runserver
which outputs:
Performing system checks...
System check identified no issues (0 silenced).
You have unapplied migrations; your app may not work properly until they are applied.
Run 'python manage.py migrate' to apply them.
November 17, 2018 - 15:50:53
Django version 2.1, using settings 'mysite.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
Can others access this server, either from within the network or just through the internet? How would one go about checking that?
python django security server
python django security server
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
asked Nov 20 '18 at 21:28
Jaysin WorrelJaysin Worrel
82
82
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Hosting the development server on localhost (which is equivalent to 127.0.0.1) does not expose you to any risks than might already exist in your system. You would have to make a very deliberate effort to make this accessible to external connections.
If you wish to make the site accessible on a local network, you can host on 0.0.0.0. The bottom line is that you'd have to be either compromised already somehow, or have made a deliberate effort, to be any more exposed by running the development server. Just don't use it when moving to production.
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53401828%2fis-the-default-django-development-server-secure-or-can-others-access-it%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Hosting the development server on localhost (which is equivalent to 127.0.0.1) does not expose you to any risks than might already exist in your system. You would have to make a very deliberate effort to make this accessible to external connections.
If you wish to make the site accessible on a local network, you can host on 0.0.0.0. The bottom line is that you'd have to be either compromised already somehow, or have made a deliberate effort, to be any more exposed by running the development server. Just don't use it when moving to production.
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
add a comment |
Hosting the development server on localhost (which is equivalent to 127.0.0.1) does not expose you to any risks than might already exist in your system. You would have to make a very deliberate effort to make this accessible to external connections.
If you wish to make the site accessible on a local network, you can host on 0.0.0.0. The bottom line is that you'd have to be either compromised already somehow, or have made a deliberate effort, to be any more exposed by running the development server. Just don't use it when moving to production.
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
add a comment |
Hosting the development server on localhost (which is equivalent to 127.0.0.1) does not expose you to any risks than might already exist in your system. You would have to make a very deliberate effort to make this accessible to external connections.
If you wish to make the site accessible on a local network, you can host on 0.0.0.0. The bottom line is that you'd have to be either compromised already somehow, or have made a deliberate effort, to be any more exposed by running the development server. Just don't use it when moving to production.
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
Hosting the development server on localhost (which is equivalent to 127.0.0.1) does not expose you to any risks than might already exist in your system. You would have to make a very deliberate effort to make this accessible to external connections.
If you wish to make the site accessible on a local network, you can host on 0.0.0.0. The bottom line is that you'd have to be either compromised already somehow, or have made a deliberate effort, to be any more exposed by running the development server. Just don't use it when moving to production.
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
answered Nov 20 '18 at 21:42
roganjoshroganjosh
6,48031328
6,48031328
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
add a comment |
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
1
1
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
Thank you very much, good to know.
– Jaysin Worrel
Nov 20 '18 at 22:04
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
@JaysinWorrel you're welcome. You did initially accept my answer and then retracted; is there something more I need to clarify?
– roganjosh
Nov 20 '18 at 22:05
1
1
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
Nope just messed up.
– Jaysin Worrel
Nov 21 '18 at 22:56
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53401828%2fis-the-default-django-development-server-secure-or-can-others-access-it%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
