3 ms·
Maybe that it doesn't sanitize the user input, but calling that security hole is a bit of a stretch. Sure you have the freedom to use some insecure libraries wi
by type0 8y ago
Maybe that it doesn't sanitize the user input, but calling that security hole is a bit of a stretch. Sure you have the freedom to use some insecure libraries with flask but the same could be said about any framework.
- sametmax 8y agoDjango protect you out of the box of xss, csrf, and click jacking while providing you with a proven robust extensible auth mechanism. When using flask, you have to be able to make decisions about those. Many devs are not able to. I'm ok with it: not everybody has to be an expert to be a great element in a company. But flask gives those profile a false sense of easiness.
- flasker11 8y agoHave you ever written a flask app yourself? It provides identical protections against xss etc. that you mentioned, as well as an auth plugin and tutorials on doing auth right... I think it's unfair to spread a negative opinion of Flask because you had to work on an app that used it badly.
- type0 8y agoI have seen a fare share of terribly written django apps, riddled with security holes that weren't so obvious at the first glimpse. > But flask gives those profile a false sense of easiness. It allows you to prototype very fast, not everyone needs nor wants the hand-holding that django provides. Don't get me wrong I think django is fantastic at what it gives out of the box but saying that flask is insecure is just fud. Also - try Pyramid, you'll never know when it suits your needs https://trypyramid.com/ https://trypyramid.com/