3 ms·
A bit unrelated, but I find funny most frameworks don't even have something to prevent CSRF. Most devs don't even know what CSRF are, and some know it only as "
by BiteCode_dev 5y ago
A bit unrelated, but I find funny most frameworks don't even have something to prevent CSRF. Most devs don't even know what CSRF are, and some know it only as "the stuff I need to disable because some ajax POST won't work otherwise".
In fact, every time somebody choose flask over Django, I ask what they are going to do about CSRF, only to get a blank stare. Same with manual PHP or using most nodejs web libs.
There are so many websites that are vulnerable to this, and it's something we know well, and have solutions for. Imagine what we don't know about. The internet is really made of swiss cheese.
- vollmond 5y agoNow that you mention it, I can't think of any other concept I eventually researched and learned about just because of frameworks complaining (Spring framework in my case).
- jonathan-adly 5y agoWorking with Django has completely spoiled me as a dev. Now, I really can't stand manually configuring a lot of the "normal" good-practices that Django gives you for free.
- BiteCode_dev 5y agoXSS escaping, sql injection prevention, click-jacking protection, password hashing updates... Django provides so much security out of the box. That's before we even talk about features.
- sshine 5y agoNot for free. It just feels free because you already paid with your time to learn the conventions. :)
- tedivm 5y agoMost people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.
- BiteCode_dev 5y agoLast month flask has been downloaded 45 177 334 times, flask-wtf 3 466 675 times. That's 7%.
- yes_man 5y ago1. Not all servers serve web pages. As for how big percentage of Flask users thus don’t need CSRF is hard to guess 2. WTForms is not the only way to do CSRF tokens with Flask My point is that it’s not plausible to infer with certainty that some large part of Flask users would not have CSRF tokens just because Flask has more downloads than Flask-WTF
- wink 5y agoJust anecdata but me (and my team back then) used Flask for years, I'm pretty sure zero of our apps even had a form for users to interact with. It used to be very popular for REST APIs.
- nickjj 5y agoIndeed, you can also create a Jinja macro to auto-insert the token into all of your forms too, here's a code example[0]. It's a 100% solved problem both on the Flask back-end and template side with an ability to opt out of it when you need to on the back-end such as when accepting webhooks from another service. [0]: https://github.com/nickjj/build-a-saas-app-with-flask/blob/1c135c22c0724d50f6b506e8426dc7f58632fdf3/snakeeyes/templates/macros/form.html#L52 https://github.com/nickjj/build-a-saas-app-with-flask/blob/1...
- antihero 5y agoI haven't really thought about CSRF since building things that are purely static frontend + JS request based. How prevalent are these things in this space? Are they still a problem?
- phonethrowaway 5y agoflask-security is a trivial addon.