5 ms·
Same with flask and django. And the worst is that the flask version is often riddle with security holes (not flask's fault) that would have been prevented for f
by sametmax 8y ago
Same with flask and django. And the worst is that the flask version is often riddle with security holes (not flask's fault) that would have been prevented for free.
I actually always say that despite the apparent easiness of the micro framwork hello world, you have to actually be very skilled to use them correctly to do anything beyong a few pages. While a full feature framework will make a beginer produce a decent work by default.
- linux2647 8y agoWhat sort of security holes in Flask are you referring to?
- deleted 8y ago[deleted]
- type0 8y agoMaybe that it doesn't sanitize the user input, but calling that security hole is a bit of a stretch. Sure you have the freedom to use some insecure libraries with flask but the same could be said about any framework.
- sametmax 8y agoDjango protect you out of the box of xss, csrf, and click jacking while providing you with a proven robust extensible auth mechanism. When using flask, you have to be able to make decisions about those. Many devs are not able to. I'm ok with it: not everybody has to be an expert to be a great element in a company. But flask gives those profile a false sense of easiness.
- flasker11 8y agoHave you ever written a flask app yourself? It provides identical protections against xss etc. that you mentioned, as well as an auth plugin and tutorials on doing auth right... I think it's unfair to spread a negative opinion of Flask because you had to work on an app that used it badly.
- type0 8y agoI have seen a fare share of terribly written django apps, riddled with security holes that weren't so obvious at the first glimpse. > But flask gives those profile a false sense of easiness. It allows you to prototype very fast, not everyone needs nor wants the hand-holding that django provides. Don't get me wrong I think django is fantastic at what it gives out of the box but saying that flask is insecure is just fud. Also - try Pyramid, you'll never know when it suits your needs https://trypyramid.com/ https://trypyramid.com/
- chc 8y agoThey didn't say there are holes in Flask, but that the Flask version of an app is more likely to contain holes (presumably because you're less pushed into safe defaults).
- sametmax 8y agoNot flasks. Flask users code. The last flask app I worked on had a custom auth scheme with md5 hashed passwords. You see because flask is so minimal, many beginers use it for an easy start, only to rewrite square wheels when the project gets real.
- toyg 8y agoThere are situations where Flask is good enough and very fast to deploy, while Django is overkill and more complicated to set up. I agree that, should a system get significantly complex, eventually you will want Django; but a lot of projects simply never get there. That's why it's good to have a choice anyway.
- sametmax 8y agoAnything that requires auth or database access requires setup that a lot of dev will get wrong. E.g : sqlalchemy sessions are very often badly handled. Of course you could write sql by hand, but then you loose the entire ecosystem of blueprints.
- deleted 8y ago[deleted]
- mixmastamyk 8y ago> you loose the entire ecosystem of blueprints. Blueprints for models?
- sametmax 8y agoYes. E.g : sqlalchemy admin.
- tankerdude 8y agoLately, I’ve used Flask with Connexion, JWT, SQLAlchemy, and Alembic did my microservice APIs. Relatively few lines of code that comes with validation, API playground, and defined routes plugged in via the swagger doc. The main I ssue is having a nice admin page, tbh. Flask doesn’t have one like Django but eh. Good enough I suppose.
- shreyas-satish 8y agoThere's Flask-Admin[0] which I found really useful. [0] https://flask-admin.readthedocs.io/en/latest/ https://flask-admin.readthedocs.io/en/latest/