flask-talisman

What it is and what it does

Flask-Talisman is a lightweight Flask extension that wraps your application to automatically inject security-focused HTTP headers. It enforces HTTPS by default (unless debug mode is on), enables HTTP Strict Transport Security, sets secure session cookies, and applies a strict Content Security Policy to mitigate XSS attacks. It also prevents clickjacking via X-Frame-Options, disables MIME type sniffing, and controls referrer leakage.

The extension is designed to be drop-in: you instantiate it with your Flask app and it handles header injection on every response. Most settings are configurable—you can adjust CSP rules, HSTS behavior, frame options, and cookie attributes to match your application's needs. The package has no runtime dependencies, making it lightweight to add to an existing Flask project.

Use it for:

• Add HTTPS enforcement and HSTS headers to a Flask app without manual header management.
• Protect against XSS attacks by applying a strict default Content Security Policy.
• Prevent clickjacking by setting X-Frame-Options and other framing controls.
• Secure session cookies automatically by marking them as secure, httponly, and samesite.
• Customize security headers per-view to allow exceptions for specific endpoints.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Flask extension that automatically sets HTTP security headers to protect against common web vulnerabilities like XSS, clickjacking, and MIME sniffing.

Yes, with conditions. Flask-Talisman is a straightforward, low-friction way to add essential security headers to Flask applications. It has no dependencies, installs cleanly, and is marked Production/Stable. However, the package is dormant—last updated in August 2023—so verify that its defaults and behavior align with current security best practices and your Flask version before deploying to production.

Install

flask-talisman on PyPI

pip install flask-talisman

uv add flask-talisman

poetry add flask-talisman

Installing flask-talisman

Before you install

Low friction installation with no runtime dependencies. Maintenance is dormant—last release was in August 2023, though the repository remains active and the package is marked Production/Stable.

License in practice

Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.

Quickstart

pip install flask-talisman

from flask import Flask
from flask_talisman import Talisman

app = Flask(__name__)
Talisman(app)

Verify before relying

• Whether dormant status affects compatibility with recent Flask versions or modern security standards.
• Current test coverage and whether the package has been validated against recent security guidelines.
• Compatibility with Python versions beyond 3.9, given the classifier list ends there.

Package facts

Evidence: flask_talisman-1.1.0-py2.py3-none-any.whl

Keywords: flask, security, https, xss

Tags

More Python Modules packages