Is it possible for aiohttp to bind to multiple ports especially for websocket?

[Zhaoxun]

I know for different incoming connections I can route them to different paths in aiohttp, like django does.

But I have a cluster of internal servers and want their connections to come from a totally port different than the one a client visits for security. Then since I know exactly where other servers are, I can easily set up firewall rules to restrict that specific port to host connections from a specific IP address (or specific subnet) to avoid a malicious client mocking a server to connect to this aiohttp server program, which only requires knowing the correct path.

So is it possible for a "web.WebSocketResponse()" to bind to another port? Or only one tcp can be used for one aiohttp python program?

[agammann]

WebSocketResponse handles a WebSocket on an incoming request; the listening port belongs to a site. One aiohttp process can run more than one TCPSite:

from aiohttp import web

runner = web.AppRunner(app)
await runner.setup()
public_site = web.TCPSite(runner, "0.0.0.0", 8080)
peer_site = web.TCPSite(runner, "10.0.0.5", 8081)
await public_site.start()
await peer_site.start()
# Later: await runner.cleanup()

I tested WebSocket handshakes through both sites with aiohttp 3.14.5. One important detail for your security goal: when both sites use the same application/runner, all its routes are reachable through both ports. For peer-only routes, put them in a separate application with its own AppRunner and TCPSite on the internal address/port, then apply your firewall rule there. The application runner documentation specifically supports serving on multiple hosts/ports.