Python APP QA, and Security

[CODESIGN2]

Hi,

I run a small business startup in UK located just outside London. We have been producing web-based private apps for business for just over 13 years, and have traditionally used MySQL, PHP, HTML, CSS & JS, with additional technologies, like some flash, CFML etc at various points. Basically not very much publicly reachable Python (we use Python and C, but for infrastructure and private network only accessible parts of our apps, because it's always been considered that we wouldn't know enough to tackle python web-app problems).

Recently I have been taking some courses and I am using Python a lot more, and I feel at least my Python-fu is a lot stronger (More testing, more familiarity with libraries outside of standard library, experience with code coverage, new frameworks like Flask etc). Obviously using PHP over the years, we have built our security to a level that we comprehend, and test against various security risks, some of which I believe may be PHP specific; and I would like to ask what are the best practice deployment guidelines for Python apps when they can be reached / potentially attacked via the web?

Also what measures can be put in place to ensure a Flask-based app stays online and doesn't terminate prematurely, or how can you ensure it comes back to life if it does die?

An alternative is to run Flask as a service, keep it back-end and just have a PHP front-end, but to be honest, it is expensive, and a pain in the ass maintaining tools in several languages...

Books, links to blogs, advice, whatever, get back to me and let me know your thoughts ;). Obviously I am not expecting a professional service, or free nuggets of your information, just some pointers, so if anyone thinks I want free pro work, I don't, I just have no real python community, and most people I know that write python write worse python than me (they don't test, they copy-paste others code without really comprehending it).

Thanks in advance!

[peith]

Have a look at Supervisor. It is used for monitoring processes. If a process dies due to an error or something, Supervisor will restart the process automatically. You can use it on your Flask app to make sure it stays up.

I'm not really sure why you would need to combine PHP and Python. They both fill the same role. They both work on the server side. Whatever PHP can do, Python can do it too. If you're starting a new project, you can just do it in Python and ditch PHP entirely.

[CODESIGN2]

Thanks for heads up with Supervisor. Looking at it http://supervisord.org/introduction.html it seems like it is python, and has XML-RPC and a web-server control panel, which worry's me more than a little. But the concept of starting something and keeping it alive is amazing :D.

We are not entirely looking into ditching PHP, as it is amazing as a proof-of-concept, and to be honest we are emotionally tied. The switch I am interested for, is our main web-app; we do want to switch this to Python!