I have finally set up my VSCode to debug a Flask application. I fire a curl request to http://localhost:5000/whatever and hit the breakpoint. So far, so good. Now I want to store some request examples as a Postman collection. I import the same curl request into Postman, parametrize the domain as an environment variable, hit the “Send” button and…

403 forbidden. Ok, there must be something wrong. Let’s check! After a couple of minutes of searching I realize I should not have used the env variable, the endpoint path is now duplicated, http://localhost:5000/whatever/whatever. Whatever, let’s shorten it as it is supposed to be…

403 forbidden. It still doesn’t work. Ah, Postman is clever, it has Initial Value and Current value for the variables. Let’s manually edit the current value, restart the app out of superstition and fire the request again…

403 forbidden. Things are getting overly suspicious! Let me fiddle with the Postman headers: Content-Type, User-Agent, Accept… After switching the headers on and off in different combinations in random order I notice the response headers. They say Content-Length: 0 and Server: AirTunes/610.19.1. AirTunes doesn’t look like a Flask server, does it? I fire the curl request again in my terminal and see that the server is Werkzeug.

After some duckduckgoing I found out that Apple listens as AirPlay Receiver on the port 5000 (standard Flask port), because it wasn’t registered by Internet Assigned Numbers Authority. For some reason Apple decided 5000 will be a good port (and Flask and dotnet Core and Heroku and Docker Registry). I don’t know who was the first to claim the port and why the subsequent implementations didn’t consider the first ones. I also don’t know why curl reaches my Flask app and Postman doesn’t. It’s tiring researching absolutely unnecessary piece of information.

So I changed my Flask port and it worked. I hope it helps to you as well.