flexmeasures icon indicating copy to clipboard operation
flexmeasures copied to clipboard

Published 20 hours ago • verified publisher icon FlexMeasures

Switch to Flask-Talisman

Open nhoening opened this issue 2 years ago • 2 comments

For ensuring httpS, we are using Flask-SSLify, which is not maintained anymore.

The current recommendation is https://github.com/wntrblm/flask-talisman

It also comes with some other benefits. See also the recommendation to use a CSRF protection library. That can be done in one go or in another ticket.

nhoening avatar Jan 18 '22 11:01 nhoening

We should use force_https_permanent, as the status 302 (temp redirect) caused some problems for me recently (redirected POST to GET)

nhoening avatar Jan 18 '22 15:01 nhoening

It seems we'd need to find the right content policy for external CDN content, as the default is strict.

nhoening avatar Jan 18 '22 15:01 nhoening