Python's http.server module can serve static files for a short-lived test or trusted transfer. It is not a production web server and does not provide authentication, authorization, TLS, rate limiting, or hardened handling of hostile traffic.
Network Sharing · Lesson 3
Simple HTTP Server
Learn how to expose a controlled directory temporarily with Python's HTTP server.
Preparing a Share Directory
Create a dedicated directory containing only files intended for exposure. Review hidden files, symlinks, permissions, and sensitive metadata before starting. Avoid serving a home directory, repository root, credential directory, or system path.
Use --directory so the shared root is explicit:
$ python3 -m http.server 8000 --directory /srv/temporary-share
When no index file is present, the module normally generates a directory listing. Anyone who can reach the listener may be able to enumerate and download served content.
Why use --directory /srv/temporary-share?
Controlling the Listening Address
Bind to loopback when only the same host should connect:
$ python3 -m http.server 8000 --bind 127.0.0.1 --directory /srv/temporary-share
To share on a trusted network, bind deliberately to an appropriate interface address and confirm firewall policy. Running without a restrictive bind commonly listens on all available interfaces, which may expose the directory beyond the intended network.
Who can normally reach a server bound to 127.0.0.1?
Testing Access
From the serving host, request a known file and inspect the response:
$ curl -f http://127.0.0.1:8000/example.txt
For an authorized remote test, use the selected interface address instead of loopback. Confirm both that the intended file is accessible and that a file outside the document root is not. Browser success alone does not establish appropriate exposure or confidentiality.
What port is selected explicitly in python3 -m http.server 8000?
Stopping and Cleaning Up
Run the temporary service in a supervised terminal and stop it with Ctrl-C when the transfer finishes. Verify the listener is gone:
$ ss -ltn 'sport = :8000'
Remove temporary copies according to data-handling policy and revert any temporary firewall rule. For persistent, authenticated, or Internet-facing distribution, use a maintained server configured with access control and TLS.
What should happen after the temporary transfer is complete?
Lesson complete
You finished Simple HTTP Server
You can now run a temporary Python HTTP server with a bounded exposure.
Serve only a dedicated, reviewed directory.
Bind to the narrowest appropriate address.
Test intended access and unintended boundaries.
Stop the listener and clean up temporary access afterward.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account