Flask security documentation

flask-sec-doc.md

- Cross-Site Scripting (XSS)

- Cross-Site Request Forgery (CSRF)

- JSON Security

- SSL/HTTPS

For implementing HTTPS on your server

Below some packages in suggestion order that implements this protocol:

• flask-talisman
• flask-sslify
• flask-secure-headers

Security Headers

This sections contains sections headers supported by Flask and a list of packages in suggestion order that implements it

- Content Security Policy (CSP)

For enhancing security and preventing common web vulnerabilities such as cross-site scripting and MITM related attacks

Example

Content-Security-Policy: default-src https:; script-src 'nonce-{random}'; object-src 'none'

To learn more check this link

• flask-talisman
• flask-csp
• flask-secure-headers

- HTTP Strict Transport Security (HSTS)

For automatically redirect HTTP to HTTPS on all the website url's and prevent MITM attacks

Example

Strict-Transport-Security: max-age=

Strict-Transport-Security: max-age=; includeSubDomains

Strict-Transport-Security: max-age=; preload

To learn more check this link

• flask-talisman
• flask-sslify
• flask-secure-headers

• X-FRAME-OPTIONS (Clickjacking protection)

Prevents the client clicking page elements outside of the website avoiding hijacking or UI redress attacks

Example

X-Frame-Options: DENY

X-Frame-Options: SAMEORIGIN

X-Frame-Options: ALLOW-FROM https://example.com/

To learn more check this link

• flask-talisman
• flask-secure-headers

- X-Content-Type-Options

Prevents XSS by blocking requests on clients and forcing then to read the content type instead of first opening it.

Example

X-Content-Type-Options: nosniff

To learn more check this link

• flask-talisman
• flask-secure-headers

- Cookie options

For setting cookies on client-side storage

Example

Set-Cookie: [cookie-name]=[cookie-value]

To learn more check this link

• flask-talisman
• flask-secure-headers

- HTTP Public Key Pinning (HPKP)

For associating clients with web servers throught a certificate key and prevent MITM attacks

Example

Public-Key-Pins: pin-sha256="base64=="; max-age=expireTime [; includeSubDomains][; report-uri="reportURI"]

To learn more check this link

• flask-talisman
• flask-secure-headers

References:

• https://docs.djangoproject.com/en/1.11/topics/security/
• https://blog.appcanary.com/2017/http-security-headers.html
• https://developer.mozilla.org
• https://csp.withgoogle.com/docs/index.html