{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"Flask-Paranoid detects and blocks session hijacking by validating that each request originates from the same IP address and user agent as the initial session, clearing the session if either changes.","skillfed_tags":["session-security","flask-extension"],"use_cases":["Protect web applications from attackers using stolen session cookies by detecting IP or user-agent mismatches.","Add an extra layer of session security to Flask apps handling sensitive user data without complex custom middleware.","Detect and block requests from compromised sessions that originate from unexpected geographic locations or devices.","Implement automatic session invalidation when a user's network or browser environment changes unexpectedly."],"what_it_does":"Flask-Paranoid is a Flask extension that adds session hijacking detection by binding each user session to the IP address and user agent from the first request. On every subsequent request, it recalculates a token based on the current IP and user agent and compares it to the one from the initial session. If either the IP or user agent changes\u2014indicating the session cookie may have been stolen and used from a different location\u2014the extension clears the session and blocks the request, redirecting to a configurable view.\n\nThe package is designed as a lightweight, transparent layer that requires minimal setup: instantiate Paranoid with your Flask app, optionally set a redirect_view, and the protection activates automatically. It depends only on Flask and supports current Python versions (3.6+). With low install friction and a permissive MIT license, it's straightforward to integrate into existing Flask applications.","worth_installing":"Yes, if you need lightweight session hijacking detection in a Flask app and can accept that legitimate IP changes (mobile networks, VPNs) will trigger session invalidation. The package is actively maintained, has no known vulnerabilities, and installs with minimal friction. It's a reasonable choice for adding a simple, IP-based session binding layer, though you should verify whether its approach fits your threat model and user base."},"id":"flask-paranoid","links":{"html":"https://skillfed.io/packages/flask-paranoid","md":"https://skillfed.io/packages/flask-paranoid.md","pypi":"https://pypi.org/project/flask-paranoid/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2022-04-02","license_spdx":null,"license_treatment":"permissive","name":"Flask-Paranoid","python_support":"supports_current","summary":"Simple user session protection"},"popularity":{"monthly_downloads":77829,"position":14489,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.3.0"}