Package: talisman
Talisman is a small Flask extension that handles setting HTTP headers
that can help protect against a few common web application security
issues.The default configuration:Forces all connects tohttps, unless running with debug enabled.EnablesHTTP Strict Transport
Security.Enables HSTS preloading. If you register your application withGoogle’s HSTS preload list,
Firefox and Chrome will never load your site over a non-secure
connection.Sets Flask’s session cookie tosecure, so it will never be set if
you application is somehow accessed via a non-secure connection.Sets Flask’s session cookie tohttponly, preventing JavaScript
from being able to access its content. CSRF via Ajax uses a separate
cookie and should be unaffected.SetsX-Frame-OptionstoSAMEORIGINto avoidclickjacking.Sets a strictContent Security
Policyofdefault-src:'self'. This is intended to almost completely
prevent Cross Site Scripting (XSS) attacks. This is probably the only
setting that you should reasonably change. See thesection
belowon configuring this.In addition to Talisman, youshould always use a cross-site request
forgery (CSRF) library. I highly recommendFlask-SeaSurf,
which is based on Django’s excellent library.Installation & Basic UsageInstall viapip:pip install talismanfromflaskimportFlaskfromtalismanimportTalismanapp=Flask(__name__)Talisman(app)There is also a fullExample App.Optionsforce_https, defaultTrue, forces all non-debug connects tohttps.force_https_permanent, defaultFalse, uses301instead of302forhttpsredirects.frame_options, defaultSAMEORIGIN, can beSAMEORIGIN,DENY, orALLOWFROM.frame_options_allow_from, defaultNone, a string indicating
the domains that arrow allowed to embed the site via iframe.strict_transport_security, defaultTrue, whether to send HSTS
headers.strict_transport_security_max_age, defaultONE_YEAR_IN_SECS,
length of time the browser will respect the HSTS header.strict_transport_security_include_subdomains, defaultTrue,
whether subdomains should also use HSTS.content_security_policy, defaultdefault-src:'self', see thesection below.session_cookie_secure, defaultTrue, set the session cookie
tosecure, preventing it from being sent over plainhttp.session_cookie_http_only, defaultTrue, set the session
cookie tohttponly, preventing it from being read by JavaScript.Per-view optionsSometimes you want to change the policy for a specific view. Theframe_options,frame_options_allow_from, andcontent_security_policyoptions can be changed on a per-view basis.fromflaskimportFlaskfromtalismanimportTalisman,ALLOW_FROMapp=Flask(__name__)talisman=Talisman(app)@app.route('/normal')defnormal():return'Normal'@app.route('/embeddable')@talisman(frame_options=ALLOW_FROM,frame_options_allow_from='*')defembeddable():return'Embeddable'Content Security PolicyThe default content security policy is extremely strict, and will
prevent loading any resources that are not in the same domain as the
application.A slightly more permissive policy is available attalisman.GOOGLE_CSP_POLICY, which allows loading Google-hosted JS
libraries, fonts, and embeding media from YouTube and Maps.You can and should create your own policy to suit your site’s needs.
Here’s a few examples adapted fromMDN:Example 1This is the default policy. A web site administrator wants all content
to come from the site’s own origin (this excludes subdomains.)csp={'default-src':'\'self\''}Example 2A web site administrator wants to allow content from a trusted domain
and all its subdomains (it doesn’t have to be the same domain that the
CSP is set on.)csp={'default-src':['\'self\'','*.trusted.com']}Example 3A web site administrator wants to allow users of a web application to
include images from any origin in their own content, but to restrict
audio or video media to trusted providers, and all scripts only to a
specific server that hosts trusted code.csp={'default-src':'\'self\'','image-src':'*','media-src':['media1.com','media2.com',],'script-src':'userscripts.example.com'}Here, by default, content is only permitted from the document’s origin,
with the following exceptions:Images may loaded from anywhere (note the*wildcard).Media is only allowed from media1.com and media2.com (and not from
subdomains of those sites).Executable script is only allowed from userscripts.example.com.Example 4A web site administrator for an online banking site wants to ensure that
all its content is loaded using SSL, in order to prevent attackers from
eavesdropping on requests.csp={'default-src':'https://onlinebanking.jumbobank.com'}The server only permits access to documents being loaded specifically
over HTTPS through the single origin onlinebanking.jumbobank.com.Example 5A web site administrator of a web mail site wants to allow HTML in
email, as well as images loaded from anywhere, but not JavaScript or
other potentially dangerous content.csp={'default-src':['\'self\'','*.mailsite.com',],'img-src':'*'}Note that this example doesn’t specify ascript-src; with the
example CSP, this site uses the setting specified by thedefault-srcdirective, which means that scripts can be loaded only from the
originating server.DisclaimerThis is not an official Google product, experimental or otherwise.There is no silver bullet for web application security. Talisman can
help, but security is more than just setting a few headers. Any
public-facing web application should have a comprehensive approach to
security.Contributing changesSeeCONTRIBUTING.mdLicensingApache 2.0 - SeeLICENSE