Running Flask Applications on Port 80: Secure Deployment and Best Practices

Root Cause Analysis of Port 80 Binding Issues

When attempting to bind a Flask application to port 80, the common "Address already in use" error indicates port occupation by other processes. The lsof -i :80 command confirms Apache server is listening on this port. As the standard HTTP port, port 80 is typically occupied by web servers like Apache or Nginx, which is the direct cause of binding failures.

Not Recommended: Stopping Existing Services

While stopping Apache processes can free port 80, this approach presents significant issues. Firstly, Flask's built-in development server is not designed for production environments, lacking the security and performance required for actual deployment. Official documentation explicitly warns: "Do not use the builtin development server in production." Secondly, directly stopping existing web services may affect other running websites or applications.

Recommended Solution: Reverse Proxy Configuration

Using a reverse proxy represents the best practice for Flask deployment. Apache, as a mature and stable web server, efficiently handles static files while forwarding dynamic requests to the Flask application through the mod_wsgi module.

Apache Reverse Proxy Configuration Example

# Enable necessary Apache modules
sudo a2enmod proxy
sudo a2enmod proxy_http

# Create virtual host configuration file
<VirtualHost *:80>
    ServerName example.com
    
    # Static file handling
    Alias /static /path/to/your/static/files
    <Directory /path/to/your/static/files>
        Require all granted
    </Directory>
    
    # Dynamic request proxying
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:5000/
    ProxyPassReverse / http://127.0.0.1:5000/
</VirtualHost>

Technical Advantages of Reverse Proxy

Adopting a reverse proxy architecture provides multiple technical benefits: SSL termination enables more secure and efficient HTTPS configuration; professional web server security mechanisms offer better protection; static file handling performance significantly improves; load balancing and caching capabilities enhance system scalability.

Alternative Approach Comparison

Beyond reverse proxy, other options exist. Port forwarding redirects traffic at the network level but involves complex configuration and network device dependencies. DNS redirection is simple to implement but cannot hide the actual port number. Permission binding tools like authbind allow non-root users to bind privileged ports but still fail to address the core issue that development servers are unsuitable for production environments.

Production Environment Deployment Recommendations

For production environments, a complete WSGI server deployment approach is recommended. Use Gunicorn or uWSGI as application servers, combined with Nginx or Apache as front-end web servers. This architecture ensures both performance and comprehensive security, representing industry-recognized best practices.