Great tutorial. Since you're already using backbone.js why not plug in CSRF protection with Flask-SeaSurf? (http://flask.pocoo.org/extensions/ http://flask.poc

Great tutorial. Since you're already using backbone.js why not plug in CSRF protection with Flask-SeaSurf? (http://flask.pocoo.org/extensions/ http://flask.pocoo.org/extensions/) If you use this backbone.js change then CSRF is practically invisible: https://github.com/alanhamlett/backbone/commit/91941afe693ae85bc5303b8e61982876cd5ae415 https://github.com/alanhamlett/backbone/commit/91941afe693ae... Also, if building an api with Flask make sure you use blueprints with a url prefix so your api routes become relative, which means less typing: http://flask.pocoo.org/docs/blueprints/ http://flask.pocoo.org/docs/blueprints/