This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!
Project Description

What is Flask-Mitten?

Adds security functions to Flask applications for preventing some of the basic threats.

Features

Flask-Mitten supports Flask applications to prevent following threats.

  • Clickjacking
  • CSRF
  • Information disclosure through banner grabbing
  • JSON hijacking
  • Session fixation

It bundles functions of following Flask extensions.

More details, see the implementation.

Usage

Installation

Install the extension with the following commands:

pip install Flask-Mitten

Configuration

Apply the extention to your app:

from flaskext.mitten import Mitten
app = Flask(__name__)
mitten = Mitten(app)

Request headers are overridden to prevent clickjacking and information disclosure.

If you want to set your own banner, you can do it:

mitten.banner = "My Nice Banner!"

Preventing Session Fixation

After login, call a regenerate method of session object:

session.regenerate()

The session ID is regenerated, and it prevents session fixation.

To discard a session, call a destroy method:

session.destroy()

Preventing CSRF

To embed CSRF token, add following line to your template:

<input type="hidden" name="_csrf_token" value="{{ csrf_token() }}" />

A POST request is protected against CSRF automatically.

If you want to exclude a route from CSRF protection, use a csrf_exempt decorator:

@mitten.csrf_exempt
@app.route('/public_api/', methods=['POST'])
def public_api():
    return "result", 200

Preventing JSON Hijacking

If you send a JSON response, you could use a json decorator to avoid JSON hijacking or rendering JSON responses by direct browsing:

@mitten.json
@app.route('/json_api/')
def json_api():
    return jsonify(result='success')

More

For more details, see an example app.

Release History

Release History

0.2.1

This version

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.2

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.1

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
Flask-Mitten-0.2.1.zip (12.2 kB) Copy SHA256 Checksum SHA256 Source Mar 4, 2012

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting