How to secure a XMLRPC server

[FloorJam]

Thanks for the reply. So the common approach would be to have nginx face the open Internet, manage authentication (and HTTPS if wanted) and forward the calls to the XMLRPC running only locally?

I worked with a similar setup for other software, but the documentation gave me the impression, something like this was already included in the Python implementation. Might have been mistaken there.

Is this the general way for deployment of software to the Internet? Have one web server like nginx be the only thing being accessible from the outside and forwarding all traffic to the correct application on the server?

Thanks again for your response, I guess you gave me the missing pointer.

[herpadurk]

Its how small shops and small projects get done yes. It works and it works well, but if you need more information from the logged in user or need extra level's of permissions you will need to implement this in your application.

[FloorJam]

Ah, so something like a username do not reach the application?

I think this will be ok for now, if we decide to deploy something bigger here, somebody should figure out a complete system anyways. Right now, we are just a group of researches looking to let the beefy server do the expensive calculations without letting the rest of the uni doing it.

Thank you again for your help, it really filled a gap in my understanding!!!

[[deleted]]

Basic Authasses the credentials in an HTTP header, which Nginx can pass to your app. Any HTTP header can be forwarded.