I have a remote server that only allows logins through a browser https request. I want to download images from it, and cache them and use them in a local job. What are the security risks with automating this job using the python requests library assuming the local server is secure and stores the password securely?

  • If it's through an http request (instead of an https request) who cares? It's going across the internet in plain text anyway.
    – user143703
    Apr 1 '15 at 19:09
  • its https. I'm talking about blatant security holes from doing this. Apr 1 '15 at 19:10
  • Security risk would be how you handle the storing of credentials in your script in addition to how the data is transmitted.
    – Bad Dos
    Apr 1 '15 at 19:11
  • 5
    Your question as written is too vague.
    – Zoredache
    Apr 1 '15 at 19:18
  • 2
    As @Zoredache said....expound on it, but it needs to exist on security.stackexchange.com instead in my opinion.
    – TheCleaner
    Apr 1 '15 at 19:36

Your question is kind of vague as written, but...

I have a remote server that only allows logins through a browser https request.

Er. Basic or digest authentication, I assume? Or Windows integrated security, if you're using IIS?

Assuming that you're just pulling down images from some kind of password-protected web server location via standard HTTPS, the biggest risk I can see is the credentials. You would mainly be risking unauthorized people viewing the images, or maybe someone replacing the images with something malicious if the server is compromised.

(Unless you mean "images" as in "executables" that you download and execute. Then more the second thing.)

But it's possible that I don't fully understand the question.

  • Images means pngs from a tableau server. My assumption is that since requests cookies are not stored on disk, that really the only risk is stored credentials. Apr 1 '15 at 19:55
  • Stored credentials and people viewing the pngs without permission. It sounds like the stored credentials would be low-privilege, yes? If you're not concerned about people viewing the pngs without permission, and the credentials are read-only for just the pngs, you might decide that the risk level is acceptable. Apr 1 '15 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.