Things to do before realease my Flask web app
Hi everyone, I like coding, i started sutding it by myself 4 years ago. Now I want to start gaining some money from it, that's why i decided to help local businesses with their own websites and web app. I used flask for a while and i know how to create everything that i'll need but i don't know what are the things to do before releasing a website to the web in terms of security, inspection, rapidity, ecc.., so if someone of you can help me to figure out what i need to do I would be really grateful to him. Thanks
With regards to security I would ask the question: What is at risk? For myself, my organization, and my customers. If you know what is at risk (for example, exposing passwords or personal identifiable information) you can think of ways on how to mitigate it (use an external identity provider like Auth0 e.g.).
With regards to rapidity, I would recommend looking for some performance bench-marking tools of which there are many. Performance issues are often seen because of database calls and file system access.
Not sure what you mean with "inspection".
Personally, I would primarily consider security first. You don't want to make major mistakes there. The rest can be fixed later and improved over time.
what are other things about security besides authentication that I can improve using external providers?
How can I prevent other types of attacks such as Ddos or something?
Should i have to worry about those or not?
From a security perspective, the biggest advantage of using an external authentication provider is that you don't have to worry yourself about registering users, storing passwords, asking personal information etc. It can safe you from a whole lot of trouble.
If you don't want to use something like Auth0 or similar, you may want to consider to at least over social login options, like Facebook and Google logins. It provides security and improves user experience.
You may also think about ddos-attacks, but the good thing about these kind of attacks is that it impacts you most. Customer data is not stolen because of it.
It depends a bit of the kind of service of course, but if your customers can live with a few hours/days downtime in rare circumstances you may not want to focus on ddos prevention first.