Securely Hosting a Streamlit App with Restricted Access

Deployment
1

Hi everyone,

I’m working on a Streamlit app that contains sensitive data, and I need to ensure that only a few authorized users can access it. The data must remain completely secure, and any unauthorized access or data leakage is not acceptable.

Some key points:

  • The app should not be publicly accessible.
  • Only specific users should have access.
  • Data leakage must be prevented at all costs.
  • I’m open to hosting on cloud platforms or self-hosting if needed.

What are the best practices for securing a Streamlit app in this scenario? Are there recommended authentication methods, encryption techniques, or deployment strategies that you’d suggest?

Thanks in advance!

3 Likes
2

In most major cloud providers, you can host your Streamlit app in a container. (e.g. Here’s a Docker tutorial.) Typically, you can set network permissions on your container so your cloud host gatekeeps access. Alternatively, you can surface your app publicly and include user authentication within your app’s logic. (Or you can do both!)

Streamlit version 1.42.0 just released native support for user authentication with OIDC. You can use that to verify user identities within your app, for example.

Snowflake is an enterprise-grade secure environment where you can host both your data and your app. Within Snowflake, there are two primary options for hosting Streamlit apps: Streamlit in Snowflake and Snowpark Container Services.

  • Streamlit in Snowflake offers a web interface for in-browser editing of your code. However, it’s a couple versions behind the latest open-source version of Streamlit and there are a few unsupported Streamlit features. It may be a little more expensive to run than Snowpark Container Services.
  • Snowpark Container Services is a flexible, cost-efficient way to host your Streamlit app in Snowflake. You can configure the container like you would a Docker container, installing any version of Python or Python library you need. You can give your app a public URL, but anyone visiting the URL will need to authenticate as an allowed user in your Snowflake account.

In Community Cloud, you are allowed one private app, but as a community-based product, it’s not recommend for business use.