web2py

Overview

The administrative interface, admin, is only accessible from localhost unless you run web2py behind Apache with mod_proxy. If admin detects a proxy, the session cookie is set to secure and admin login does not work unless the communication between the client and the proxy goes over HTTPS; this is a security measure. All communications between the client and admin must always be local or encrypted; otherwise an attacker would be able to perform a man-in-the middle attack or a replay attack and execute arbitrary code on the server.

The core

Depending on how you are invoking web2py, there are four modes of operation for web2py cron.

• soft cron: available under all execution modes
• hard cron: available if using the built-in web server (either directly or via Apache mod_proxy)
• external cron: available if you have access to the system's own cron service
• No cron

Deployment recipes