title: How to Protect Flask from ZMEU
body: <p>Forgive me if this is a duplicate question, but I'm running a Flask app using Celery and Rabbit MQ in a Kubernetes service. The service is run as a public-facing LoadBalancer. The problem I've seen is with ZMEU scan attacks which mess up the Flask uri structure and render the app unusable:</p>
  
  <pre><code>10.240.0.4 - - [19/Apr/2018 04:48:05] "GET / HTTP/1.1" 400 -
  10.240.0.4 - - [19/Apr/2018 04:48:10] "GET /index.action HTTP/1.1" 400 -
  10.244.2.1 - - [19/Apr/2018 07:32:29] "GET / HTTP/1.1" 400 -
  10.244.2.1 - - [19/Apr/2018 08:54:38] "GET / HTTP/1.1" 400 -
  10.244.2.1 - - [19/Apr/2018 11:13:06] "GET /w00tw00t.at.blackhats.romanian.anti-sec :) HTTP/1.1" 400 -
  10.240.0.4 - - [19/Apr/2018 11:13:11] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 400 -
  10.240.0.4 - - [19/Apr/2018 11:13:16] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 400 -
  10.244.2.1 - - [19/Apr/2018 11:13:21] "GET /pma/scripts/setup.php     
  ...
  </code></pre>
  
  <p>This occurs after successful pings to the URI. I have a healthcheck occurring because this silently renders the app unreachable, though the container itself is healthy and doesn't exit.</p>
  
  <p>While I am working on securing the endpoint itself, I feel that it's more of a band-aid, and the app code should be resilient to this type of attack. Is there a way for me to catch any unspecified URI (not defined by an <code>@app.route()</code> decorator)?</p>
  
  <p>EDIT: I've made an attempt to only accept requests that have a uri header in the request by using redirects in a general uri-path <code>http://my.flask.app:80/</code> to point to the proper service, but this hasn't remedied the problem</p>