werkzeug WSGI only reachable via "localhost"

Question

I'm having a weird issue testing my flask app. I reduced it to the following, let this be 'test.py':

if __name__ == '__main__':
    from flask import Flask

    app = Flask(__name__)
    @app.route('/hello')
    def hello():
        return 'hello\n'

    app.run(debug = True)

So I simply run this as:

python test.py 
 * Running on http://127.0.0.1:5000/
 * Restarting with reloader

Now on another terminal I can do this:

>> curl http://localhost:5000/hello
hello

However, what does not work, is this:

>> curl http://192.168.178.23:5000/hello
curl: (7) couldn't connect to host

Where ifconfig en1 gives: [...] inet 192.168.178.23 [...]

Originally I'd like to test my actual app from another machine within the local network - that's how I came across this issue.

I also tried with my browser, wget and other "clients".

If I replace all the Flask/Werkzeug stuff with the python builtin BaseHTTPServer & Handler, things are fine - which lets me conclude that there's some weird issue going on with flask or werkzeug underneath, rather than e.g. with my network configuration.

I'm not too familiar with all low-level io, so don't really know where to start looking the for the source of the problem.

Apologies in advance, if I'm missing something stupid here...

Answer 1

By default, Flask listens only on your loopback interface, as exposing the debug interface (which allows execution of arbitrary Python code) to other machines is a serious security risk. To override this, try:

app.run(host='0.0.0.0', debug=True)

However, make sure your system is appropriately shielded from untrusted machines.