{"id":16117298,"url":"https://github.com/nickbabcock/bottle-ssl","last_synced_at":"2025-03-15T10:30:59.483Z","repository":{"id":6418058,"uuid":"7656467","full_name":"nickbabcock/bottle-ssl","owner":"nickbabcock","description":"A simple web page using BottlePy and SSL","archived":false,"fork":false,"pushed_at":"2024-04-25T11:14:07.000Z","size":169,"stargazers_count":56,"open_issues_count":0,"forks_count":12,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-02-27T00:04:38.217Z","etag":null,"topics":["beaker","bottle","cheroot","cherrypy","docker","pam","python","ssl"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nickbabcock.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2013-01-16T23:59:34.000Z","updated_at":"2024-04-25T11:14:10.000Z","dependencies_parsed_at":"2023-12-13T13:25:53.433Z","dependency_job_id":"b9bf4ea5-192c-4a96-a0de-7b83b847cd03","html_url":"https://github.com/nickbabcock/bottle-ssl","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickbabcock%2Fbottle-ssl","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickbabcock%2Fbottle-ssl/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickbabcock%2Fbottle-ssl/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickbabcock%2Fbottle-ssl/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nickbabcock","download_url":"https://codeload.github.com/nickbabcock/bottle-ssl/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243718815,"owners_count":20336589,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["beaker","bottle","cheroot","cherrypy","docker","pam","python","ssl"],"created_at":"2024-10-09T20:43:52.621Z","updated_at":"2025-03-15T10:30:59.182Z","avatar_url":"https://github.com/nickbabcock.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"![ci](https://github.com/nickbabcock/bottle-ssl/workflows/ci/badge.svg)\n\n# bottle-ssl\n\nThis repo contains a sample web app that demonstrates a secure login mechanism\nfor linux users using SSL on top of Bottle. The authentication mechanism\nrequires the app to be ran as root on a linux system, but this is just for\ndemonstration purposes. Other than authentication, the code is cross platform\nand python 2 and 3 compatible. See the [Docker instructions](#docker) if you\nwant to try out the sample app.\n\n## Introduction\n\n[Bottle][bottle] is a great micro web framework that can be as minimalist or\nfeature rich as one wants. Bottle is great for rapid development and for\ndebugging. However, Bottle is not recommended to be deployed in production\nwithout additional plugins, as it lacks security [and speed][serverOptions].\nThe developers of Bottle know this and so made Bottle easily extendible.\n\nA common want in web programming is having a secure login page and to remember\nthe logged in user. This cannot be achieved without extending Bottle through\nvarious plugins. This project starts a web page that'll allow a user to log in\nover TLS 1.2 (other protocols are disabled) using their name and password on a\nlinux server and remember the user through the use of a cookie.\n\n## Requirements:\n\n- Python 2.7.9, 3.4, or later. Minimum requirement to run Bottle and friends.\n- [Bottle][bottle]: This will be the web framework that will have everything based on it.\n- [CherryPy][cherrypy] (now cheroot): Bottle can't achieve SSL or heavy\n  traffic, so this is where CherryPy comes in. Since CherryPy is based on\n  cheroot, we'll be using cheroot directly.\n- [Beaker][beaker]: Will be used as Bottle middleware that allows session data.\n- [OpenSSL][openssl]: Program used to generate the self signed certificate.\n\nBefore you [`poetry install`](https://github.com/sdispater/poetry) the python\ndependencies you will need to install Openssl (most likely with the command\n`sudo apt-get install openssl`)\n\n## OpenSSL and Self Signed Certificates\n\nFirst the SSL certificate and private key are generated using OpenSSL. It is\nabsolutely critical to generate a private key with at least 1024 bits\n(recommended: 2048/4096) else you'll run into security or other issues (eg.\n[Internet Explorer will not display the page no matter what if there are less\nthan 1024 bits][1024bit]).  The generated files, in this case are privkey.pem and\ncacert.pem. For simplicity's sake, these are stored inside the directory.\n\n```bash\nopenssl req -new -x509 -days 1095 -nodes -newkey rsa:2048 -out cacert.pem -keyout privkey.pem\n```\n\n## Bottle and SSL\n\nMy recommendation is to not use get bogged down in working with the builtin\nservers that bottle recognizes, as sorting out dependencies can be a pain.\nInstead craft your own bottle adapter with cheroot:\n\n```python\nfrom bottle import ServerAdapter, run\n\nclass SSLCherootAdapter(ServerAdapter):\n    def run(self, handler):\n        from cheroot import wsgi\n        from cheroot.ssl.builtin import BuiltinSSLAdapter\n        import ssl\n\n        server = wsgi.Server((self.host, self.port), handler)\n        server.ssl_adapter = BuiltinSSLAdapter(\"cacert.pem\", \"privkey.pem\")\n\n        # By default, the server will allow negotiations with extremely old protocols\n        # that are susceptible to attacks, so we only allow TLSv1.2\n        server.ssl_adapter.context.options |= ssl.OP_NO_TLSv1\n        server.ssl_adapter.context.options |= ssl.OP_NO_TLSv1_1\n\n        try:\n            server.start()\n        finally:\n            server.stop()\n\nrun(host='localhost', port=8080, server=SSLCherootAdapter)\n```\n\n## Alternatives\n\nIf creating your own adapter is too burdensome, run the app with\n[gunicorn](http://gunicorn.org/) (one will need to slightly change the code to\nreturn an app). Gunicorn will bring the speed and the ssl, so one could get\nrid of CherryPy (cheroot). I definitely recommend checking out gunicorn for a\nmiddle of the road solution.\n\nFor a heavyweight solution run nginx, apache, HAProxy in front of bottle.\n\n## Testing SSL Configuration\n\n[sslyze](https://github.com/nabla-c0d3/sslyze) will run a suite of checks on a\ngiven site and report back which protocols, cipher suites, and vulnerabilities\nare available.\n\n## Docker\n\nIncluded in this repo is a Dockerfile that spins up a bottle app using a self\nsigned certificate and demonstrates authentication. Since this is a sample app,\nit's not uploaded to the registry but if you already have `docker`, building\nthe container is quite straightforward:\n\n```bash\ncd bottle-ssl\ndocker build -t nickbabcock/bottle-ssl .\ndocker run -ti -p 9443:443 nickbabcock/bottle-ssl\n```\n\nThen navigate your browser to port 9443 of the docker machine. For the\nusername, enter `BottleUser` and for the password `iambottle`\n\n[bottle]: http://bottlepy.org/\n[cherrypy]: http://cherrypy.org/\n[beaker]: http://beaker.readthedocs.org/en/latest/\n[pyopenssl]: https://launchpad.net/pyopenssl\n[openssl]: http://openssl.org/\n[serverOptions]: http://bottlepy.org/docs/dev/deployment.html#server-options\n[1024bit]: http://technet.microsoft.com/en-us/security/advisory/2661254\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickbabcock%2Fbottle-ssl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnickbabcock%2Fbottle-ssl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickbabcock%2Fbottle-ssl/lists"}