How to Serve BLOB Images via HTTPS with CORS for Hover Tooltips in FanRuan Reports

Implementation Details

Cross‑Origin Support

Add Flask-CORS and call CORS(app) to allow all origins (domains can be restricted by configuration).

HTTPS Support

Place certificate files crt.pem and key.pem (and password) on the server.

Create an ssl.SSLContext with ssl.PROTOCOL_TLS_SERVER and load the certificate chain.

Input Validation

Require the query parameter address; return HTTP 400 if missing.

Use a parameterized SQL query

SELECT file_contents FROM approval_management WHERE request_id = %s LIMIT 1;

to prevent SQL injection.

Production‑grade Server

Replace Flask’s built‑in development server with gevent.pywsgi.WSGIServer, passing the SSL context.

Full Flask Application

from flask import Flask, Response, request
from flask_cors import CORS
import pymysql
from gevent import pywsgi, monkey
import ssl

app = Flask(__name__)
CORS(app)  # enable cross‑origin

DB_CONFIG = {
    'host': 'your_database_host',
    'user': 'root',
    'password': 'your_password',
    'database': 'your_database'
}

def get_image_from_db(address):
    try:
        conn = pymysql.connect(**DB_CONFIG)
        cursor = conn.cursor()
        query = "SELECT file_contents FROM approval_management WHERE request_id = %s LIMIT 1;"
        cursor.execute(query, (address,))
        result = cursor.fetchone()
        conn.close()
        if result:
            return result[0]
        return None
    except Exception as e:
        app.logger.error(f"Database query failed: {e}")
        return None

@app.route('/get_image', methods=['GET'])
def get_image():
    address = request.args.get('address')
    if not address:
        return "Address parameter missing", 400
    blob_data = get_image_from_db(address)
    if blob_data:
        content_type = 'image/png' if blob_data.startswith(b'\x89PNG') else 'image/jpeg'
        return Response(blob_data, content_type=content_type)
    return "Image not found", 404

if __name__ == "__main__":
    host = '0.0.0.0'
    port = 5000
    certfile = './crt.pem'
    keyfile = './key.pem'
    password = 'your_certificate_password'
    monkey.patch_all()
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.load_cert_chain(certfile=certfile, keyfile=keyfile, password=password)
    server = pywsgi.WSGIServer((host, port), app, ssl_context=context)
    print(f"Service started: https://{host}:{port}")
    server.serve_forever()

After the service starts, request an image with a URL such as https://your_host:5000/get_image?address=12345. The response can be used as an image URL in FanRuan report cells to display the picture on mouse hover.