Security Considerations

import io
import secrets
from flask import Flask, request

app = Flask(__name__)
app.config.update(
    SECRET_KEY=secrets.token_hex(32),   # a real application reads this from configuration
    MAX_CONTENT_LENGTH=64 * 1024,        # every request body: at most 64 KiB
    MAX_FORM_MEMORY_SIZE=16 * 1024,      # any one text field: at most 16 KiB
    MAX_FORM_PARTS=50,                   # at most 50 fields per form
)


@app.post("/books")
def add_book():
    return {"title": request.form["title"]}, 201


@app.post("/books/<int:book_id>/cover")
def upload_cover(book_id):
    request.max_content_length = 2 * 1024 * 1024   # this view only: 2 MiB
    request.max_form_memory_size = 2 * 1024 * 1024  # see the note below the example
    cover = request.files["cover"]
    return {"book": book_id, "size": len(cover.read())}


client = app.test_client()
assert client.post("/books", data={"title": "Dune"}).status_code == 201
multipart = "multipart/form-data"
assert client.post("/books", data={"title": "x" * 100_000}).status_code == 413      # over 64 KiB
assert client.post("/books", data={"title": "x" * 20_000}, content_type=multipart).status_code == 413
many = {f"f{i}": "1" for i in range(60)}
assert client.post("/books", data=many, content_type=multipart).status_code == 413  # over 50 parts
big = {"cover": (io.BytesIO(b"0" * 200_000), "c.png")}
assert client.post("/books/1/cover", data=big).status_code == 200

from flask import Flask, render_template_string
from markupsafe import Markup, escape

app = Flask(__name__)

with app.test_request_context():
    title = "<script>alert(1)</script>"
    page = render_template_string("<h1>{{ title }}</h1>", title=title)
    assert page == "<h1>&lt;script&gt;alert(1)&lt;/script&gt;</h1>"

    # escape() returns a Markup object: already safe, never escaped twice.
    assert str(escape(title)) == "&lt;script&gt;alert(1)&lt;/script&gt;"

    # Marking text as safe switches the protection off for that value.
    unsafe = render_template_string("<h1>{{ title }}</h1>", title=Markup(title))
    assert unsafe == "<h1><script>alert(1)</script></h1>"

import secrets
from flask import Flask, jsonify
from flask_wtf.csrf import CSRFProtect, generate_csrf

app = Flask(__name__)
app.config["SECRET_KEY"] = secrets.token_hex(32)
csrf = CSRFProtect(app)                 # checks every POST, PUT, PATCH and DELETE


@app.get("/csrf-token")
def csrf_token():
    return jsonify(csrf_token=generate_csrf())      # a single-page app reads it once


@app.post("/books/<int:book_id>/delete")
def delete_book(book_id):
    return {"deleted": book_id}


@app.post("/webhooks/payments")
@csrf.exempt                              # authenticated by a signature, not a cookie
def webhook():
    return {"ok": True}


client = app.test_client()
assert client.post("/books/7/delete").status_code == 400            # forged: no token

token = client.get("/csrf-token").get_json()["csrf_token"]          # same session cookie
ok = client.post("/books/7/delete", headers={"X-CSRFToken": token})
assert ok.status_code == 200
assert client.post("/webhooks/payments").status_code == 200

from flask import Flask, jsonify, request

app = Flask(__name__)


@app.get("/api/books")
def books():
    return jsonify([{"id": 1, "title": "Dune"}])      # a top-level array is fine


@app.post("/api/books")
def add():
    data = request.get_json()                          # 415 unless Content-Type is application/json
    return jsonify(data), 201


client = app.test_client()
resp = client.get("/api/books")
assert resp.mimetype == "application/json" and resp.get_json()[0]["id"] == 1
assert client.post("/api/books", data="title=Dune").status_code == 415
assert client.post("/api/books", json={"title": "Dune"}).status_code == 201

from flask import Flask

app = Flask(__name__)


@app.get("/")
def index():
    return "Bookshelf"


@app.after_request
def add_security_headers(response):
    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
    response.headers["Content-Security-Policy"] = "default-src 'self'"
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "SAMEORIGIN"
    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
    return response


headers = app.test_client().get("/").headers
assert headers["X-Content-Type-Options"] == "nosniff"
assert headers["Content-Security-Policy"] == "default-src 'self'"

import secrets
from flask import Flask, session

app = Flask(__name__)
app.config.update(
    SECRET_KEY=secrets.token_hex(32),
    SESSION_COOKIE_NAME="__Host-session",     # the __Host- prefix needs Secure, Path=/ and no Domain
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE="Lax",
    PERMANENT_SESSION_LIFETIME=600,           # seconds; also bounds the signature age
)


@app.post("/login")
def login():
    # authenticate the user first (see the authentication pages), then:
    session.clear()                  # drop anything an attacker may have planted before login
    session["user_id"] = 42
    session.permanent = True
    resp = app.make_response({"ok": True})
    resp.set_cookie("theme", "dark", max_age=600, secure=True, httponly=True, samesite="Lax")
    return resp


client = app.test_client()
cookies = client.post("/login", base_url="https://localhost").headers.getlist("Set-Cookie")
session_cookie = next(c for c in cookies if c.startswith("__Host-session="))
for attribute in ("Secure", "HttpOnly", "SameSite=Lax", "Path=/", "Expires="):   # permanent: expires in 10 minutes
    assert attribute in session_cookie, attribute
assert "Domain" not in session_cookie
assert any(c.startswith("theme=dark") and "Secure" in c for c in cookies)

from flask import Flask, url_for

app = Flask(__name__)
app.config["TRUSTED_HOSTS"] = ["bookshelf.example.com", ".example.org"]


@app.get("/reset")
def reset():
    return url_for("reset", _external=True)


client = app.test_client()
assert client.get("/reset", base_url="http://bookshelf.example.com").status_code == 200
assert client.get("/reset", base_url="http://shop.example.org").status_code == 200
assert client.get("/reset", base_url="http://example.org").status_code == 200
assert client.get("/reset", base_url="http://evil.test").status_code == 400

from flask import Flask, request, url_for
from werkzeug.middleware.proxy_fix import ProxyFix

app = Flask(__name__)
# one proxy sets X-Forwarded-For, -Proto and -Host: trust exactly one hop
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)


@app.get("/where")
def where():
    return {"ip": request.remote_addr, "url": url_for("where", _external=True)}


forwarded = {
    "X-Forwarded-For": "203.0.113.9",
    "X-Forwarded-Proto": "https",
    "X-Forwarded-Host": "bookshelf.example.com",
}
data = app.test_client().get("/where", headers=forwarded).get_json()
assert data == {"ip": "203.0.113.9", "url": "https://bookshelf.example.com/where"}

import re

CONTROL = re.compile(r"[\x00-\x08\x0b-\x1f\x7f]")      # keeps tab (\x09) and newline (\x0a)


def clean_snippet(text: str) -> str:
    return CONTROL.sub("", text)


tricky = "import y\bose\bm\bi\bt\be\b"
assert clean_snippet(tricky) == "import yosemite"
assert clean_snippet("line one\n\tline two") == "line one\n\tline two"
assert "\b" not in clean_snippet(tricky)

import os
import secrets
from flask import Flask


def create_app(env: str | None = None) -> Flask:
    env = env or os.environ.get("BOOKSHELF_ENV", "production")
    app = Flask(__name__)
    app.config["DEBUG"] = env == "development"
    if env == "production" and app.debug:
        raise RuntimeError("debug mode must not be enabled in production")
    app.config["SECRET_KEY"] = os.environ.get("BOOKSHELF_SECRET_KEY") or secrets.token_hex(32)
    return app


assert create_app("production").debug is False
assert create_app("development").debug is True

flask --app bookshelf run --debug          # development laptop only, bound to 127.0.0.1
gunicorn --bind 0.0.0.0:8000 "bookshelf:create_app()"   # production: a real server, no debugger

import os
import secrets
from flask import Flask


def load_secret(name: str) -> str:
    value = os.environ.get(name)
    if not value:
        raise RuntimeError(f"environment variable {name} is required")
    return value


os.environ["BOOKSHELF_SECRET_KEY"] = secrets.token_hex(32)     # stands in for the real environment
app = Flask(__name__)
app.config["SECRET_KEY"] = load_secret("BOOKSHELF_SECRET_KEY")
assert len(app.config["SECRET_KEY"]) == 64

try:
    load_secret("BOOKSHELF_DATABASE_PASSWORD")
    missing = False
except RuntimeError:
    missing = True
assert missing                                  # refuses to start without it

from urllib.parse import urljoin, urlsplit
from flask import Flask, redirect, request, url_for

app = Flask(__name__)


def is_safe_target(target: str | None) -> bool:
    if not target:
        return False
    base = urlsplit(request.host_url)
    absolute = urlsplit(urljoin(request.host_url, target))
    return absolute.scheme in ("http", "https") and absolute.netloc == base.netloc


@app.post("/login")
def login():
    next_url = request.args.get("next")
    return redirect(next_url if is_safe_target(next_url) else url_for("home"))


@app.get("/")
def home():
    return "home"


client = app.test_client()
assert client.post("/login?next=/books/7").headers["Location"] == "/books/7"
assert client.post("/login?next=https://evil.test/").headers["Location"] == "/"
assert client.post("/login?next=//evil.test/").headers["Location"] == "/"
assert client.post("/login?next=javascript:alert(1)").headers["Location"] == "/"

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE books (id INTEGER PRIMARY KEY, title TEXT, owner TEXT)")
db.execute("INSERT INTO books (title, owner) VALUES ('Dune', 'ana'), ('Emma', 'bob')")
owner = "x' OR '1'='1"                                      # attacker-controlled

injectable = db.execute(f"SELECT title FROM books WHERE owner = '{owner}'").fetchall()
parameterised = db.execute("SELECT title FROM books WHERE owner = ?", (owner,)).fetchall()

assert len(injectable) == 2          # the condition became always-true: every row leaks
assert parameterised == []           # the whole string is just a (non-matching) value

import tempfile
from pathlib import Path
from flask import Flask, send_from_directory
from werkzeug.exceptions import NotFound

root = Path(tempfile.mkdtemp())
(root / "covers").mkdir()
(root / "covers" / "dune.html").write_text("<script>alert(1)</script>")
(root / "secret.txt").write_text("not for download")

app = Flask(__name__)


@app.get("/files/<path:name>")
def download(name):
    # as_attachment sends Content-Disposition: attachment, so uploaded HTML is never rendered
    return send_from_directory(root / "covers", name, as_attachment=True)


client = app.test_client()
ok = client.get("/files/dune.html")
assert ok.status_code == 200
assert ok.headers["Content-Disposition"].startswith("attachment")
assert client.get("/files/../secret.txt").status_code == 404
assert client.get("/files/%2e%2e/secret.txt").status_code == 404

pip install pip-audit
pip-audit -r requirements.txt            # audit a requirements file
pip-audit --local                         # audit the current virtual environment
pip-audit -r requirements.txt -f json -o audit.json     # machine-readable report for CI