Feat: Server over https (#1487)

rajnisht7 · web-flow · commit 91ed3fa3fe5d · 2026-07-22T17:26:06.000+05:30
* Update run_server.py

* Update __init__.py

* Update run_server.py

* Update __init__.py

* Update __init__.py

* Update run_server.py

* Update README.md

* Update __init__.py

* Update __init__.py

* Update __init__.py

* Update run_server.py

* Update __init__.py

* Update __init__.py

* Update run_server.py

* Update README.md

* Update run_server.py

* Update run_server.py

* Update __init__.py

* Update __init__.py

* Update run_server.py

* Update README.md

* Update __init__.py

* Update __init__.py

* Update __init__.py

* Update __init__.py

* Update __init__.py

* Update __init__.py
diff --git a/README.md b/README.md
@@ -227,6 +227,32 @@ VISDOM_USE_ENV_CREDENTIALS=1 visdom -enable_login
 You can also use `VISDOM_COOKIE` variable to provide cookies value if the cookie file wasn't generated, or the
 flag `-force_new_cookie` was set.
 
+#### HTTPS Support
+
+To run the visdom server over HTTPS,user need to provide an SSL certificate and key file:
+
+```bash
+# Generate a self-signed certificate (for development only)
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+
+# Start the server with HTTPS
+python -m visdom.server -ssl_certfile cert.pem -ssl_keyfile key.pem
+```
+
+Access the server at `https://localhost:8097`.
+
+Connect via the Python client:
+```python
+# For Production - real CA-signed certificate (default)
+vis = visdom.Visdom(server="https://myserver.com")
+
+# For Development - self signed certificate
+vis = visdom.Visdom(server="https://localhost", ssl_verify=False)
+```
+
+> **Note**: `ssl_verify=False` disables certificate verification and should only be used in development with self-signed certificates. Do not use in production.
+
+
 #### Python example
 ```python
 import visdom
diff --git a/py/visdom/__init__.py b/py/visdom/__init__.py
@@ -11,6 +11,7 @@
 import os
 import os.path
 import requests
+import ssl
 import traceback
 import threading
 import websocket  # type: ignore
@@ -678,10 +679,22 @@ def __init__(
         use_polling=False,
         session_idle_timeout=SESSION_IDLE_TIMEOUT,
         session_idle_check_interval=SESSION_IDLE_CHECK_INTERVAL,
+        ssl_verify=None,
     ):
         parsed_url = urlparse(server)
         if not parsed_url.scheme:
             parsed_url = urlparse("http://{}".format(server))
+
+        if parsed_url.scheme == "http" and ssl_verify is not None:
+            raise ValueError(
+                "ssl_verify is only valid with HTTPS. "
+                "Use server='https://...' to enable HTTPS."
+            )
+
+        if ssl_verify is None:
+            ssl_verify = True
+
+        self.ssl_verify = ssl_verify
         self.server_base_name = parsed_url.netloc
         self.server = urlunparse((parsed_url.scheme, parsed_url.netloc, "", "", "", ""))
         self.endpoint = endpoint
@@ -748,13 +761,20 @@ def __init__(
         # storage for data associated with specific windows
 
         # Setup for online interactions
-        self._send(
-            {
-                "eid": env,
-            },
-            endpoint="env/" + env,
-        )
-
+        result = self._send({"eid": env}, endpoint="env/" + env)
+        if self.send and result is False:
+            if self.raise_exceptions:
+                raise ConnectionError(
+                    "Could not connect to server at {}:{}.".format(
+                        self.server, self.port
+                    )
+                )
+            else:
+                logger.warning(
+                    "Could not connect to server at {}:{}.".format(
+                        self.server, self.port
+                    )
+                )
         # when talking to a server, get a backchannel
         if send and use_incoming_socket:
             self.setup_socket()
@@ -800,6 +820,10 @@ def session(self):
             sess = requests.Session()
             if self.proxies:
                 sess.proxies.update(self.proxies)
+            if isinstance(self.ssl_verify, str):
+                sess.verify = self.ssl_verify
+            elif not self.ssl_verify:
+                sess.verify = False
             if self.username:
                 resp = sess.post(
                     "%s:%s%s" % (self.server, self.port, self.base_url),
@@ -995,11 +1019,22 @@ def run_socket(*args):
                             + self.session.cookies.get("user_password", "")
                         },
                     )
-                    ws.run_forever(
-                        http_proxy_host=self.http_proxy_host,
-                        http_proxy_port=self.http_proxy_port,
-                        ping_timeout=100.0,
-                    )
+                    run_forever_kwargs = {
+                        "http_proxy_host": self.http_proxy_host,
+                        "http_proxy_port": self.http_proxy_port,
+                        "ping_timeout": 100.0,
+                    }
+                    if ws_scheme == "wss":
+                        if isinstance(self.ssl_verify, str):
+                            run_forever_kwargs["sslopt"] = {
+                                "cert_reqs": ssl.CERT_REQUIRED,
+                                "ca_certs": self.ssl_verify,
+                            }
+                        elif not self.ssl_verify:
+                            run_forever_kwargs["sslopt"] = {
+                                "cert_reqs": ssl.CERT_NONE,
+                            }
+                    ws.run_forever(**run_forever_kwargs)
                     ws.close()
                 except Exception as e:
                     logger.error("Socket had error {}, attempting restart".format(e))
@@ -1039,8 +1074,10 @@ def _handle_post(self, url, data=None):
         self._last_post_time = time.time()
         had_session = self._session is not None
         try:
-            r = self.session.post(url, data=data)
+            r = self.session.post(url, data=data, timeout=(20, None))
             return r.text
+        except requests.exceptions.SSLError:
+            raise
         except (requests.ConnectionError, requests.Timeout):
             if not had_session:
                 raise
@@ -1052,7 +1089,7 @@ def _handle_post(self, url, data=None):
                 except Exception:
                     pass
                 self._session = None
-            r = self.session.post(url, data=data)
+            r = self.session.post(url, data=data, timeout=(20, None))
             return r.text
 
     def _send(self, msg, endpoint="events", quiet=False, from_log=False, create=True):
@@ -1094,6 +1131,23 @@ def _send(self, msg, endpoint="events", quiet=False, from_log=False, create=True
                 ),
                 data=json.dumps(msg, cls=NanSafeEncoder),
             )
+        except requests.exceptions.SSLError as e:
+            ssl_msg = (
+                "SSL certificate verification failed for {}:{}. "
+                "If using a self-signed certificate, pass ssl_verify=False. "
+                "If using mkcert, run: "
+                "export REQUESTS_CA_BUNDLE=$(mkcert -CAROOT)/rootCA.pem".format(
+                    self.server, self.port
+                )
+            )
+            if self.raise_exceptions:
+                raise ConnectionError(ssl_msg) from e
+            else:
+                if not quiet:
+                    print("SSL Error:")
+                    print("-" * 60)
+                    print(ssl_msg)
+                return False
         except (requests.RequestException, requests.ConnectionError, requests.Timeout):
             if self.raise_exceptions:
                 raise ConnectionError("Error connecting to Visdom server")
diff --git a/py/visdom/server/run_server.py b/py/visdom/server/run_server.py
@@ -16,6 +16,7 @@
 import hashlib
 import logging
 import os
+import ssl
 import sys
 import errno
 import socket
@@ -70,6 +71,8 @@ def start_server(
     use_frontend_client_polling=False,
     bind_local=False,
     eager_data_loading=False,
+    ssl_certfile=None,
+    ssl_keyfile=None,
 ):
     logging.info("Server started")
     app = Application(
@@ -83,6 +86,21 @@ def start_server(
     )
     bind_addr = "127.0.0.1" if bind_local else None
     family = socket.AF_INET if bind_local else socket.AF_UNSPEC
+
+    ssl_ctx = None
+    if ssl_certfile and ssl_keyfile:
+        if not os.path.isfile(ssl_certfile):
+            raise FileNotFoundError(f"SSL certificate file not found: {ssl_certfile}")
+        if not os.path.isfile(ssl_keyfile):
+            raise FileNotFoundError(f"SSL key file not found: {ssl_keyfile}")
+        ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+        ssl_ctx.load_cert_chain(ssl_certfile, ssl_keyfile)
+        logging.info("SSL enabled")
+
+    server = tornado.httpserver.HTTPServer(
+        app, max_buffer_size=1024**3, ssl_options=ssl_ctx
+    )
+
     try:
         sockets = tornado.netutil.bind_sockets(port, address=bind_addr, family=family)
     except OSError as e:
@@ -94,7 +112,6 @@ def start_server(
             raise
     port = sockets[0].getsockname()[1]
     app.port = port
-    server = tornado.httpserver.HTTPServer(app, max_buffer_size=1024**3)
     server.add_sockets(sockets)
 
     logging.info("Application Started")
@@ -105,10 +122,13 @@ def start_server(
     if "HOSTNAME" in os.environ and hostname == DEFAULT_HOSTNAME:
         hostname = os.environ["HOSTNAME"]
 
+    scheme = "https" if ssl_ctx else "http"
+
     if print_func is None:
-        print("You can navigate to http://%s:%s%s" % (hostname, port, base_url))
+        print("You can navigate to %s://%s:%s%s" % (scheme, hostname, port, base_url))
     else:
         print_func(port)
+
     ioloop.IOLoop.current().start()
     app.subs = []
     app.sources = []
@@ -188,6 +208,22 @@ def main(print_func=None):
         action="store_true",
         help="Load data from filesystem when starting server (and not lazily upon first request).",
     )
+    parser.add_argument(
+        "-ssl_certfile",
+        metavar="ssl_certfile",
+        type=str,
+        default=None,
+        help="Path to SSL certificate file (.pem or .crt) to enable HTTPS. "
+        "Must be used together with -ssl_keyfile.",
+    )
+    parser.add_argument(
+        "-ssl_keyfile",
+        metavar="ssl_keyfile",
+        type=str,
+        default=None,
+        help="Path to SSL private key file (.pem or .key) to enable HTTPS. "
+        "Must be used together with -ssl_certfile.",
+    )
     FLAGS = parser.parse_args()
 
     # Process base_url
@@ -197,6 +233,9 @@ def main(print_func=None):
         "/"
     ), "base_url should not end with / as it is appended automatically"
 
+    if bool(FLAGS.ssl_certfile) != bool(FLAGS.ssl_keyfile):
+        parser.error("-ssl_certfile and -ssl_keyfile must be provided together.")
+
     try:
         logging_level = int(FLAGS.logging_level)
     except ValueError:
@@ -274,6 +313,8 @@ def main(print_func=None):
         use_frontend_client_polling=FLAGS.use_frontend_client_polling,
         bind_local=FLAGS.bind_local,
         eager_data_loading=FLAGS.eager_data_loading,
+        ssl_certfile=FLAGS.ssl_certfile,
+        ssl_keyfile=FLAGS.ssl_keyfile,
     )
 
 
