Prevent direct file access to server files in tornado

Question

I'm using python with tornado webserver. the application works fine but I can't find a way to prevent the user on accessing server files directly via url. for example I have the following files in the server:

program.py
index.html
main.html

i wanted to prevent the user from accessing the above server files directly via web url
ex: localhost:8080/program.py or /index.html

i only wanted them to access localhost:8080/ or /home

Thanks in advance

from ws4py.client.tornadoclient import TornadoWebSocketClient
import tornado.ioloop
import tornado.web
import tornado.websocket
import tornado.template

SETTING_CLIENT_LISTEN_PORT = 8080
class MainHandler(tornado.web.RequestHandler):

    def get(self):
        try:
            loader = tornado.template.Loader(".")
            self.write(loader.load("index.html").generate())
        except Exception as e:
            print("exception occured", e)

class CWSHandler(tornado.websocket.WebSocketHandler):
    global  waiters

    def open(self):
        print('###FUNCTION CWSHandler.open(self) start')

    def on_close(self):
        print('###FUNCTION CWSHandler.open(self) close')

    def on_message(self, message):
        print('###FUNCTION CWSHandler.on_message msg:', message)

settings = {
    "cookie_secret": "bZJc2sWbQLKos6GkHn/VB9oXwQt8S0R0kRvJ5/xJ89E=",
    "login_url": "/",
}

application = tornado.web.Application(handlers=[
    (r'/', MainHandler),    
    (r'/cws', CWSHandler),


    (r"/(.*)", tornado.web.StaticFileHandler,{'path':'./'})
    ], cookie_secret="bZJc2sWbQLKos6GkHn/VB9oXwQt8S0R0kRvJ5/xJ89E=")

if __name__ == "__main__":
    server = tornado.httpserver.HTTPServer(application)
    server.listen(SETTING_CLIENT_LISTEN_PORT)

    try:
        tornado.ioloop.IOLoop.instance().start()
        server.stop()
    except KeyboardInterrupt:
        print("Keyboard interupt")
        pass
    finally:
        server.stop()
        tornado.ioloop.IOLoop.instance().stop()

Answer 1

The problem is with your urls, specifically:

(r"/(.*)", tornado.web.StaticFileHandler,{'path':'./'})

You have mapped r'/(.*)' to {'path': './'}, which is your project directory. So, if a request comes in like localhost:8080/program.py, it will be matched with this - /(.*) and tornado will then look for a file named program.py in your project directory. If it finds it there, it will serve that file.

You should keep all your static files in a separate directory called static (you can name it anything you want, though) inside your project dir. Then map this directory with the desired url.

Example:

(r"/(.*)", tornado.web.StaticFileHandler,{'path': 'static'})

Or better yet, serve that directory under a /static/ url instead of - .*.

(r"/static/(.*)", tornado.web.StaticFileHandler,{'path': 'static'})