Deploying Scale-up Suite web apps securely over https / TLS

Althought the Streamlit tool is designed for local use on individual PCs and does not support secure connections over HTTPS (TLS) but it is possible to make Streamlit-published models and utilities avialable over secure HTTPS (TLS) connections using a Reverse Proxy. This short note describes the process used to securely publish DynoChem models using Streamlit and the Microsoft IIS Application Request Routing and URL Rewrite tools.

This short note describes a basic setup that will allow a DynoChem model or utility published using Streamlit and running on Windows Server 2016 (or later) to be published securely. The principles demonstrated here could be extended to allow multiple models to be securely published from a single server. It could equally be extended or modified to allow multiple models running on different servers to be securely presented via a common entry point in situations where scaling or performance issue are a concern.

TLS publishing with Streamlit and IIS Reverse Proxy

For users who are not familiar with the installation and configuration of Microsoft IIS, a detailed procedure document with extensive screenshots can be downloaded from DynoChem Resources (Scale-up Account required):

IIS and Reverse Proxy Installation and ConfigurationIIS Setup for Streamlit Reverse Proxy

Assumptions / Pre-Requisites

This procedure note assumes that you already have the following up and running

Procedure

HTTP_ACCEPT_ENCODING
HTTP_X_ORIGINAL_ACCEPT_ENCODING

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://localhost:8501/{R:1}" logRewrittenUrl="true" />
                    <serverVariables>
                        <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="{HTTP_ACCEPT_ENCODING}" />
                        <set name="HTTP_ACCEPT_ENCODING" value="" />
                    </serverVariables>
                </rule>
            </rules>
            <outboundRules>
                <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml" stopProcessing="false">
                    <match filterByTags="None" pattern="^http(s)?://http://localhost:8501/(.*)" />
                    <action type="Rewrite" value="http{R:1}://[CUSTOM URL]/{R:2}" />
                </rule>
                <rule name="RestoreAcceptEncoding" preCondition="NeedsRestoringAcceptEncoding">
                    <match serverVariable="HTTP_ACCEPT_ENCODING" pattern="^(.*)" />
                    <action type="Rewrite" value="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" />
                </rule>
                <rule name="CustomAnchorHref" preCondition="ResponseIsTextAnything">
                    <match pattern="href=(.*?)http://localhost:8501/(.*?)\s" />
                    <action type="Rewrite" value="href={R:1}https://[CUSTOM URL]/{R:2} " />
                </rule>
                <rule name="CustomFormAction" preCondition="ResponseIsTextAnything">
                    <match pattern="action=(.*?)http://localhost:8501/(.*?)\\" />
                    <action type="Rewrite" value="action={R:1}https://[CUSTOM URL]/{R:2}\" />
                </rule>
                <preConditions>
                    <preCondition name="ResponseIsHtml">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                    </preCondition>
                    <preCondition name="ResponseIsTextAnything">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/(.+)" />
                    </preCondition>
                    <preCondition name="NeedsRestoringAcceptEncoding">
                        <add input="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" pattern=".*" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

[server]
enableXsrfProtection=false
enableCORS=false
enableWebsocketCompression=false

Your Dynochem model or utility will now be available over a secure SSL connection.

Disclaimer

The process described here assumes that IIS and the Reverse Proxy are running on the same server as the web models (using Dynochem, Python and Streamlit). This configuration is adequate for internal/intranet publishing or for simple demonstrations, but it is not recommended for publishing confidential models via the internet.

Where DynoChem models and utilities are to be made available via the public internet, it is strongly recommended that the IIS Reverse Proxy service be run on a separate server, that appropriate firewalling is configured and that user/access authentication processes are put in place to maximise security.

References