Flask-Talisman

Flask-Talisman wraps a Flask application and automatically applies a set of security-focused HTTP response headers on every request. Out of the box it forces HTTPS, sets HTTP Strict Transport Security (HSTS), locks down the session cookie (secure, httponly, samesite), applies a strict Content Security Policy, and sets X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers. Originally built at Google, it was designed to give Flask developers sensible, secure-by-default header behavior with a single line of setup code, while still allowing every header to be tuned globally or overridden per view.

What You Get

• One-line setup via Talisman(app) that immediately applies a secure default header policy to the whole application.
• Automatic HTTPS enforcement with configurable 301/302 redirects, disabled automatically when the app runs in debug mode.
• Configurable Content Security Policy (CSP) support, including per-request nonce generation for inline scripts/styles via csp_nonce() in Jinja templates.
• Secure session cookie defaults (Secure, HttpOnly, SameSite) applied through Flask’s own config system.
• HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Feature-Policy, and Document-Policy headers, all independently configurable.
• Per-view overrides via the @talisman(...) decorator, so specific routes (e.g. an embeddable widget) can loosen frame or CSP restrictions without weakening the app-wide policy.

Common Use Cases

• Adding baseline HTTP security headers to a new or existing Flask app with minimal code changes.
• Enforcing HTTPS and HSTS across a production Flask deployment sitting behind a reverse proxy or load balancer.
• Rolling out a strict Content Security Policy incrementally, using nonce support to keep specific inline scripts working during migration.
• Meeting basic web-application security header requirements for compliance checklists or third-party security scans (e.g. Mozilla Observatory, securityheaders.com).

Under The Hood

Architecture Flask-Talisman is built as a single Talisman class in flask_talisman/talisman.py that follows the standard Flask extension pattern: it accepts an app in its constructor (or via init_app), registers a before_request hook (_force_https, plus _make_nonce for CSP nonce generation) and an after_request hook (_set_response_headers) on the Flask app, and stores all configured policy options as instance attributes. Each header family (frame options, CSP, HSTS, referrer policy, permissions/feature/document policy) has its own small _set_*_headers method invoked in sequence from _set_response_headers, and a _get_local_options() helper merges app-wide defaults with any per-view overrides attached via the __call__ decorator, so the whole request/response cycle only touches a handful of well-scoped methods. Tech Stack The library is pure Python 3 with a single runtime dependency on flask itself (no transitive third-party dependencies), still packaged with a classic setup.py/setup.cfg rather than a modern pyproject.toml, and uses nox to run its unittest-based test suite and linting across environments — a functional but dated packaging setup for a 2024-maintained library. Code Quality The test suite in flask_talisman/talisman_test.py (344 lines) covers HTTPS redirection, HSTS behavior, per-view overrides, CSP nonce injection, and cookie flag handling using Flask’s built-in test client, and exercises both string- and dict-form policy configuration; the implementation code has no type hints and relies on descriptive docstrings on init_app rather than inline typing, and method/argument naming is consistent and readable throughout. API Design The extension follows Flask’s idiomatic init_app pattern almost exactly, so Talisman(app) alone is enough to get secure defaults, and every option is exposed as a plain keyword argument with a sensible default documented directly in the constructor’s docstring; the @talisman(...) decorator for per-view overrides mirrors Flask’s own routing decorators, keeping the learning curve low for anyone already familiar with Flask extensions.