Flask-Paranoid

What it is and what it does

Flask-Paranoid is a Flask extension that adds session hijacking detection by binding each user session to the IP address and user agent from the first request. On every subsequent request, it recalculates a token based on the current IP and user agent and compares it to the one from the initial session. If either the IP or user agent changes—indicating the session cookie may have been stolen and used from a different location—the extension clears the session and blocks the request, redirecting to a configurable view.

The package is designed as a lightweight, transparent layer that requires minimal setup: instantiate Paranoid with your Flask app, optionally set a redirect_view, and the protection activates automatically. It depends only on Flask and supports current Python versions (3.6+). With low install friction and a permissive MIT license, it's straightforward to integrate into existing Flask applications.

Use it for:

• Protect web applications from attackers using stolen session cookies by detecting IP or user-agent mismatches.
• Add an extra layer of session security to Flask apps handling sensitive user data without complex custom middleware.
• Detect and block requests from compromised sessions that originate from unexpected geographic locations or devices.
• Implement automatic session invalidation when a user's network or browser environment changes unexpectedly.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Flask-Paranoid detects and blocks session hijacking by validating that each request originates from the same IP address and user agent as the initial session, clearing the session if either changes.

Yes, if you need lightweight session hijacking detection in a Flask app and can accept that legitimate IP changes (mobile networks, VPNs) will trigger session invalidation. The package is actively maintained, has no known vulnerabilities, and installs with minimal friction. It's a reasonable choice for adding a simple, IP-based session binding layer, though you should verify whether its approach fits your threat model and user base.

Install

flask-paranoid on PyPI

pip install flask-paranoid

uv add flask-paranoid

poetry add flask-paranoid

Installing Flask-Paranoid

Before you install

Low install friction with a single Flask dependency. Maintenance is active with a recent commit in 2026, though the latest release was in 2022; the repository remains unarchived and receives ongoing attention.

License in practice

Licensed under MIT (permissive), so you can use, modify, and distribute this package freely with minimal restrictions.

Quickstart

pip install Flask-Paranoid

from flask import Flask
from flask_paranoid import Paranoid

app = Flask(__name__)
app.config['SECRET_KEY'] = 'top-secret!'
paranoid = Paranoid(app)
paranoid.redirect_view = '/'

Requires Python 3.6 or later and a Flask application with a configured SECRET_KEY.

Verify before relying

• Whether the IP/user-agent validation approach is effective against modern session-stealing techniques or proxies.
• Current test coverage and whether the package handles edge cases like legitimate IP changes (mobile networks, VPNs).
• Performance impact of token recalculation on every request.

Package facts

Evidence: Flask_Paranoid-0.3.0-py3-none-any.whl

Tags

More Security packages