Have nginx handle the static files, better ?

[BobSquarePants]

Hi everyone,

I recently make nginx handle my static files...

1. Does is it wokring really faster ? I've run some home-made benchmark, but I don't see a clear delta. Does someone have some evidences / facts about it ?

2. In my Flask I had created some protection for the static file, but now nginx handle them, I have to redo it in nginx... :'( by any chance do you know an easy way (Pythonic) to create some rule in nginx and ban offer in the nftable ?

Thanks.

[ThiefMaster]

Static files like JS, CSS, static images should be public, why do you need protection there?

For serving things like user-uploaded content where protection might make sense: Ue send_file in flask as usual, do not put those in a publicly accessible folder. There are ways to offload sending to nginx though (x-accel-redir) even for files not directly accessible via a public url.

[BobSquarePants]

Thank you @ThiefMaster ,

When I speak about protection, I mean to avoid hammering and penetration tentative (attempt on static do exist)

For non public files, indeed they should not be in static :)

Maybe you know an easy way to ban visitor that do hammering or pen. tentative ?

Thanks.

[davidism]

That's outside the scope of what we can answer here. It sounds like you're not really sure what you need yet or what things are possible. I suggest trying things out first and asking if you have a specific problem related to Flask specifically. This goes for all your recent questions, not only this one.

[BobSquarePants]

Sorry,I was thinking that Flask/github/Discussion were like a forum and anyone could answer and share experiences and help/learn in a community way. I didn't know it bother maintainers, my bad..

[ThiefMaster]

When I speak about protection, I mean to avoid hammering and penetration tentative (attempt on static do exist)

Why do you care? This is normal background noise on the net. Hell, in a typical SPA webapp it wouldn't be too hard to find all referenced static files from the JS bundles.

Maybe you know an easy way to ban visitor that do hammering or pen. tentative ?

nginx supports rate limiting: http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
Do you need it for your static files? Almost certainly not.

There are MANY more important/useful things you can do wrt security and performance in a webapp.

[BobSquarePants]

Thank you @ThiefMaster for you reply and guidance. 👍

I'm letting the discussions open if anyone have some benchmark about serving static...
But of course feel free to close it...

Cheers,