{"id":2511,"library":"flask-talisman","title":"Flask-Talisman","description":"Flask-Talisman is a small Flask extension that sets HTTP security headers to help protect against common web application security issues like Cross-Site Scripting (XSS) and clickjacking. It provides a simple way to configure Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and more. The library is actively maintained, with version 1.1.0 released in August 2023, and releases typically occur as needed for bug fixes or new feature/policy additions. [1, 3, 5]","status":"active","version":"1.1.0","language":"python","source_language":"en","source_url":"https://github.com/wntrblm/flask-talisman","tags":["flask","security","http headers","csp","hsts","xss","clickjacking"],"install":[{"cmd":"pip install flask-talisman","lang":"bash","label":"Install with pip"}],"dependencies":[{"reason":"Core web framework dependency for the extension.","package":"flask","optional":false}],"imports":[{"wrong":"from flask_talisman import Talisman","symbol":"Talisman","correct":"from flask_talisman import Talisman"}],"quickstart":{"code":"from flask import Flask\nfrom flask_talisman import Talisman\n\napp = Flask(__name__)\n# Initialize Talisman with default strict security headers\ntalisman = Talisman(app)\n\n@app.route('/')\ndef hello():\n    return 'Hello, Secure World!'\n\nif __name__ == '__main__':\n    # In production, ensure debug=False and serve over HTTPS\n    # For local development, you might need to adjust Talisman's force_https or debug settings\n    app.run(debug=True)","lang":"python","description":"This quickstart initializes a Flask application and applies default strict security headers using Flask-Talisman. The default configuration includes HTTPS enforcement (unless `debug=True`), HSTS, strict Content Security Policy, and more. [1, 2, 3]"},"warnings":[{"fix":"Migrate your application to Python 3.x to maintain compatibility and receive updates.","message":"Python 2.x support was officially deprecated in v1.0.0. Ensure your application runs on Python 3.x.","severity":"deprecated","affected_versions":">= 1.0.0"},{"fix":"Customize the `content_security_policy` and `content_security_policy_nonce_in` arguments when initializing `Talisman` to explicitly allow necessary sources or use nonces for inline content. Avoid `unsafe-inline` if possible. [15]","message":"The default Content Security Policy (CSP) is very strict (e.g., `default-src: 'self', 'object-src': 'none'`) and will block inline scripts/styles and external resources. This commonly breaks frontend frameworks or CDN-hosted assets. [1, 3, 5, 15]","severity":"gotcha","affected_versions":"All versions with default CSP"},{"fix":"No direct fix needed as this is a security best practice change. Rely on a robust Content Security Policy instead of `X-XSS-Protection`.","message":"The `X-XSS-Protection` header is disabled by default starting from v1.1.0, aligning with browser deprecation of this header. This is a change in default behavior. [GitHub Release v1.1.0]","severity":"breaking","affected_versions":">= 1.1.0"},{"fix":"Review the project's GitHub activity and community engagement for ongoing viability if long-term critical reliance is anticipated.","message":"Flask-Talisman is a fork of an earlier Google-maintained project that became unmaintained. While the current `wntrblm/flask-talisman` project is active, its history may be a consideration for long-term project stability. [5, 17]","severity":"gotcha","affected_versions":"All versions"},{"fix":"Review your Permissions Policy configuration to remove deprecated directives and explicitly configure new privacy-related ones like `browsing-topics` if desired.","message":"Permissions Policy directives have changed: `interest-cohort` was removed in v1.0.0, and `browsing-topics` was added and disabled by default in v1.1.0. [GitHub Release v1.0.0, v1.1.0]","severity":"deprecated","affected_versions":">= 1.0.0"}],"env_vars":null,"search_vec":"'1':81 '1.1.0':63 '2023':67 '3':82 '5':83 'activ':59 'addit':80 'applic':23 'august':66 'bug':75 'clickjack':33,91 'common':21 'configur':40 'content':41 'cross':28 'cross-sit':27 'csp':44,88 'extens':11 'feature/policy':79 'fix':76 'flask':2,5,10,84 'flask-talisman':1,4 'frame':52 'header':16,87 'help':18 'hsts':49,89 'http':14,45,86 'issu':25 'librari':57 'like':26 'maintain':60 'need':73 'new':78 'occur':71 'option':53 'polici':43 'protect':19 'provid':35 'releas':64,69 'script':30 'secur':15,24,42,48,85 'set':13 'simpl':37 'site':29 'small':9 'strict':46 'talisman':3,6 'transport':47 'typic':70 'version':62 'way':38 'web':22 'x':51 'x-frame-opt':50 'xss':31,90","created_at":"2026-04-11T01:31:12.770562+00:00","updated_at":"2026-04-16T15:08:27.029249+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\n  File \"/tmp/tmp8rwkyqj8/venv/lib/python3.12/site-packages/flask_talisman/__init__.py\", line 15, in <module>\n    from .talisman import (\n  File \"/tmp/tmp8rwkyqj8/venv/lib/python3.12/site-packages/flask_talisman/talisman.py\", l"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.1.0","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/wntrblm/flask-talisman","docs":null,"changelog":null,"pypi":"https://pypi.org/project/flask-talisman/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["web-framework","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-08-28","next_check":"2026-07-10","install_tag":null}}