httpApp / TFPWebModule security questions lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- PaulRowntree · 2019-12-26 23:25 After playing around with a httpproject derivative, I was hoping to get some thoughts on security before going all in on my app.  My use is a monitor of an instrument status (pressures, temperatures etc) with no control offered over the net.  I wanted to see the instrument status outside the lab (off campus); I am not worried if anyone (everyone) else also sees it.  Page requests would deliver an html script with embedded information & graphics via google charts.  This works now on my home network, behind the router.  Traffic is expected to be a few page requests per day by people working on that instrument. 1) Are there any extra code steps recommended before deploying the code to working machines in an open environment?  Are there any known vulnerabilities to the httpApp?2) If a Denial of Service attack is launched against the port, does the TFPWebModule just get bogged down, or does it launch multiple instances until out of memory?3) Any other tips would be very much appreciated!  Thanks! ---------------------------------------------------------------------- Leledumbo · 2019-12-31 18:25 Your question is rather contradicting with your expectation, though. I don't usually let the fphttpserver serve incoming request directly, instead I use another web server and reverse proxy it to the fphttpserver, it also helps with caching and static files, beyond everything else. AFAIK no known vulnerabilities so far, doesn't mean they don't exist, just unknown for now. You must let a security expert to find a security hole and exploit it to know.There's no such a defense mechanism built-in, it will just serve as many as it can, also the reason why it's not a good idea to let it serve directlyThe same as using another web server, put a load balancer / traffic limiter in front of the webserver (that's 3 layer until the request handler) if you're afraid of DoS attacks ---------------------------------------------------------------------- PaulRowntree · 2019-12-31 22:34 Quote from: Leledumbo on December 31, 2019, 07:25:51 pmYour question is rather contradicting with your expectation, though.Thanks Leledumbo, I appreciate your comments and suggestions.  Will explore the reverse proxy macinery. by 'contradictory', do you means concerned about attacks, but not about who accesses the pages?  There is nothing confidential being displayed, but who knows what some bot has been programmed to go after, or where to wreck havoc.  I can easily reduce traffic by not serving pages if traffic exceeds some low threshold. Thanks again! ---------------------------------------------------------------------- trev · 2020-01-01 03:53 Mention of "off-campus" sounds like a university in which case you might want to consult the IT department regarding firewall access which could also be used to limit access to your home IP (sounded like you would be the only one accessing the info). Just a  thought. ---------------------------------------------------------------------- PaulRowntree · 2020-01-01 06:13 Quote from: trev on January 01, 2020, 04:53:12 amMention of "off- campus" sounds like a university in which case you might want to consult the IT department regarding firewall access which could also be used to limit access to your home IP (sounded like you would be the only one accessing the info). Just a  thought. You hit the nail exactly!  I want to access the campus machine from off-campus browsers, and today proved that isn't as simple as hoped.  Time for IT .. ---------------------------------------------------------------------- PaulRowntree · 2020-01-02 22:16 I turns out that access is easy ... had to use a VPN to make it work off campus.  Works like a charm!