Hacker News Reader

Comment by BiteCode_dev | Hacker News Reader

A bit unrelated, but I find funny most frameworks don't even have something to prevent CSRF. Most devs don't even know what CSRF are, and some know it only as "the stuff I need to disable because some ajax POST won't work otherwise".

In fact, every time somebody choose flask over Django, I ask what they are going to do about CSRF, only to get a blank stare. Same with manual PHP or using most nodejs web libs.

There are so many websites that are vulnerable to this, and it's something we know well, and have solutions for. Imagine what we don't know about. The internet is really made of swiss cheese.

View on HN

Working with Django has completely spoiled me as a dev. Now, I really can't stand manually configuring a lot of the "normal" good-practices that Django gives you for free.

XSS escaping, sql injection prevention, click-jacking protection, password hashing updates...

Django provides so much security out of the box.

That's before we even talk about features.

Not for free.

It just feels free because you already paid with your time to learn the conventions. :)

Now that you mention it, I can't think of any other concept I eventually researched and learned about just because of frameworks complaining (Spring framework in my case).

Most people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.

Last month flask has been downloaded 45 177 334 times, flask-wtf 3 466 675 times. That's 7%.

1. Not all servers serve web pages. As for how big percentage of Flask users thus don’t need CSRF is hard to guess

2. WTForms is not the only way to do CSRF tokens with Flask

My point is that it’s not plausible to infer with certainty that some large part of Flask users would not have CSRF tokens just because Flask has more downloads than Flask-WTF

Just anecdata but me (and my team back then) used Flask for years, I'm pretty sure zero of our apps even had a form for users to interact with. It used to be very popular for REST APIs.

Indeed, you can also create a Jinja macro to auto-insert the token into all of your forms too, here's a code example[0]. It's a 100% solved problem both on the Flask back-end and template side with an ability to opt out of it when you need to on the back-end such as when accepting webhooks from another service.

[0]: https://github.com/nickjj/build-a-saas-app-with-flask/blob/1...

I haven't really thought about CSRF since building things that are purely static frontend + JS request based. How prevalent are these things in this space? Are they still a problem?

flask-security is a trivial addon.

Reply on news.ycombinator.com