I have a desktop app that is built on top of Django framework and frozen to .exe using PyInstaller. The idea behind it, that an application should connect to remote database(PostgreSQL) on VPS. That VPS is serving static files for this application too. So here is the question - is that option secure? Can potential hackers connect to my database and make a mess in it or replace original DB with the fake one? If they can, how should I fix that?
It is not safe to connect to a remote database in a scenario that you are describing.
For a potential hacker its a piece of cake to figure out the credentials of the remote database that you are using.
And to answer your question it will be difficult for the hacker to replace the DB with a fake one. But it wont stop him from getting all the data from your DB and modifying it.
What you should do is to have a rest-api endpoint or a grapghql endpoint to interact with the database. and you can hit that endpoint from the client app.
Related
I am trying to deploy a Django REST API on Heroku. Normally I wouldn't have any issues with this but for this app, I am using a legacy database that exists on AWS. Is it possible for me to continue to use this remote database after deploying Django to Heroku? I have the database credentials all set up in settings.py so I would assume that it should work but I am not sure.
It should not pose any problem to connect with an database on AWS.
But be sure that the database on AWS is configured to accept external access, so that Heroku can connect.
And I would sugest that you take the credentials out of the source code and put it in the Config Vars that Heroku provide (environment variables).
Will it work? I think yes, provided you configure your project and database for external access.
Should you want it? How may queries does an average page execute? Some applications may make tens of queries for every endpoint and added wait can combine into seconds of waiting for every request.
I have built an app that uses mysql database with Python, I would love to share some functionalities with different applications and that calls for an online database feature, kindly give me some insights over how i can move a python mysql database to online and how to make calls to it in order to facilitate for sharing of data between different applications.
I don't exactly know what you are calling a python database but there are some options here that you might want to consider
First, use heroku to host your app and heroku postgress to host your databaseOr you can use an EC2 aws machine to host your app and it's database (in case it's a custom code that you can't call from a browser using heroku)with both of these options you can access you database and the appp with the second one you can install other services such as ssh and other.
I'd like to build a GUI for a few Python functions I've written that pull data from MS SQL Server. My boss wants me to share the magic of Python & SQL with the rest of the team, without them having to learn any coding.
I've decided to go down the route of using Flask to create a webapp and creating an executable file using pyinstaller. I'd like it to work similarly to Jupyter Notebook, where you click on the file and it opens the notebook in your browser.
I was able to hack together some code to get a working prototype of the GUI. The issue is I don't know how to deploy it. I need the GUI/Webapp to only run on the local computer for the user I sent the file to, and I don't want it accessible via the internet (because of proprietary company data, security issues, etc).
The only documentation I've been able to find for deploying Flask is going the routine route of a web server.
So the question is, can anyone provide any guidance on how to deploy my GUI WebApp so that it's only available to the user who has the file, and not on the world wide web?
Thank you!
So, a few assumptions-- since you're a business and you're rocking a SQLServer-- you likely have Active Directory, and the computers that you care to access this app are all hooked into that domain (so, in reality, you, or your system admin does have full control over those computers).
Also, the primary function of the app is to access a SQLServer to populate itself with data before doing something with that data. If you're deploying that app, I'm guessing you're probably also including the SQLServer login details along with it.
With that in mind, I would just serve the Flask app on the network on it's own machine (maybe even the SQLServer machine if you have the choice), and then either implement security within the app that feeds off AD to authenticate, or just have a simple user/pass authentication you can distribute to users. By default random computers online aren't going to be able to access that app unless you've set your firewalls to deliberately route WAN traffic to it.
That way, you control the Flask server-- updates only have to occur at one point, making development easier, and users simply have to open up a link in an email you send, or a shortcut you leave on their desktop.
Unfortunately, you do not have control over a give users computer.
You are using flask, so your application is a web application which will be exposing your data to some port. I believe the default flask port is 5000.
Regardless, if your user opens the given port in their firewall, and this is also open on whatever router you are connected to, then your application will be publicly visible.
There is nothing that you can do from your python application code to prevent this.
Having said all of that, if you are running on 5000, it is highly unlikely your user will have this port publicly exposed. If you are running on port 80 or 8080, then the chances are higher that you might be exposing something.
A follow up question would be where is the database your web app is connecting to? Is it also on your users machine? If not, and your web app can connect to it regardless of whose machine you run it on, I would be more concerned about your DB being publicly exposed.
Yesterday, I installed an apche web server and phpmyadmin on my raspberry-py. How can I connect my raspberry-pi to databases in phpmyadmin with python? Can I use MySQL? Thank, I hope you understand my question and sorry for my bad english.
Your question is quite unclear. But from my understanding, here is what you should try doing: (Note: I am assuming you want to connect your Pi to a database to collect data and store in an IoT based application)
Get a server. Any Basic server would do. I recommend DigitalOcean or AWS LightSail. They have usable servers for just $5 per month. I recommend Ubuntu 16.04 for ease of use.
SSH into the server with your terminal with the IP address you got when you created the server
Install Apache, MySQL, Python, PHPMyAdmin on the server.
Write your web application in any language/framework you want.
Deploy it and write a separate program to make HTTP calls to the said web server.
MySQL is the Database server. Python is the language that is used to execute any instructions. PHPMyAdmin is the interface to view MySQL Databases and Tables. Apache is the webserver that serves the application you have written to deal with requests.
I strongly recommend understanding the basics of Client-Server model of computing over HTTP.
Alternatively, you could also use the approach of Using a DataBase-as-a-service from any popular cloud service provider(Eg., AWS RDS), to make calls directly into the DB.
I have a python django application that I published to heroku by connecting to github. I want some people to be able to add some information to the database from the website. If I make changes to the code, push to github and deploy the branch the database will go back to how it was at first. How can update my code for the app without changing the database?
If you host your database on a separate server, like with Amazon RDS or Heroku Postgres, and configure your code to connect to this remote host, you should have sufficient decoupling to avoid what you are talking about.