---
id: flask-paranoid
version: "0.3.0"
license: unclear
license_treatment: permissive
maintenance: active
---

# Flask-Paranoid — Simple user session protection

License: permissive · Maintenance: active · Downloads: 77.8K/mo

## What it is and what it does

Flask-Paranoid is a Flask extension that adds session hijacking detection by binding each user session to the IP address and user agent from the first request. On every subsequent request, it recalculates a token based on the current IP and user agent and compares it to the one from the initial session. If either the IP or user agent changes—indicating the session cookie may have been stolen and used from a different location—the extension clears the session and blocks the request, redirecting to a configurable view.

The package is designed as a lightweight, transparent layer that requires minimal setup: instantiate Paranoid with your Flask app, optionally set a redirect_view, and the protection activates automatically. It depends only on Flask and supports current Python versions (3.6+). With low install friction and a permissive MIT license, it's straightforward to integrate into existing Flask applications.

Use it for:

- Protect web applications from attackers using stolen session cookies by detecting IP or user-agent mismatches.
- Add an extra layer of session security to Flask apps handling sensitive user data without complex custom middleware.
- Detect and block requests from compromised sessions that originate from unexpected geographic locations or devices.
- Implement automatic session invalidation when a user's network or browser environment changes unexpectedly.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Flask-Paranoid detects and blocks session hijacking by validating that each request originates from the same IP address and user agent as the initial session, clearing the session if either changes.

Yes, if you need lightweight session hijacking detection in a Flask app and can accept that legitimate IP changes (mobile networks, VPNs) will trigger session invalidation. The package is actively maintained, has no known vulnerabilities, and installs with minimal friction. It's a reasonable choice for adding a simple, IP-based session binding layer, though you should verify whether its approach fits your threat model and user base.

## Install

pip install flask-paranoid
uv add flask-paranoid
poetry add flask-paranoid

## Installing Flask-Paranoid

Before you install: Low install friction with a single Flask dependency. Maintenance is active with a recent commit in 2026, though the latest release was in 2022; the repository remains unarchived and receives ongoing attention.

License in practice: Licensed under MIT (permissive), so you can use, modify, and distribute this package freely with minimal restrictions.

Quickstart:

pip install Flask-Paranoid

from flask import Flask
from flask_paranoid import Paranoid

app = Flask(__name__)
app.config['SECRET_KEY'] = 'top-secret!'
paranoid = Paranoid(app)
paranoid.redirect_view = '/'

Requires Python 3.6 or later and a Flask application with a configured SECRET_KEY.

Verify before relying:

- Whether the IP/user-agent validation approach is effective against modern session-stealing techniques or proxies.
- Current test coverage and whether the package handles edge cases like legitimate IP changes (mobile networks, VPNs).
- Performance impact of token recalculation on every request.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 77.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask session hijacking protection, detect stolen session cookies, ip user agent validation, flask csrf session security, prevent session fixation attacks, session-security, flask-extension

[View on SkillFed](https://skillfed.io/packages/flask-paranoid) · [View on PyPI](https://pypi.org/project/flask-paranoid/)