PyPI · #2745 most downloaded on PyPI

flask-talisman

1.1.02.2M downloads/mowntrblm/flask-talisman ↗New releases in your daily digest, changelog included.

HTTP security headers for Flask.

Release timeline

15 releases since 2016

20162018202020222024

One column per quarter.

Deprecate Python 2.x support by @eelkevdbos in #17

Increase default nonce size by @tunetheweb in #15
Deprecate Python 2.x support by @eelkevdbos in #17
Add the new default directive to the README by @QEDK in #16
Document disabling Content Security Policy by @strugee in #18
Remove obsolete Permissions Policy directive interest-cohort by @bershanskiy in #21

Full Changelog: v0.8.1...v1.0.0

0.8.114 Jun 2021

CSP nonces were applied to all directives, instead of only the specified directives ( #13 ), thanks @tunetheweb for fixing

CSP nonces were applied to all directives, instead of only the specified directives (#13), thanks @tunetheweb for fixing

0.8.010 Jun 2021

NOTE : This is the first release after the project was forked from GoogleCloudPlatform/flask-talisman.

NOTE: This is the first release after the project was forked from GoogleCloudPlatform/flask-talisman.

object-src is now a default CSP directive with value 'none'. @QEDK (#2)
Document Policy and Permissions Policy are now supported. @tunetheweb (#3)
The ingest cohort directive for Permissions Policy is by default turned off (#3)
You can now disable the X-Content-Type-Options and X-XSS-Protection headers. By default they're turned on. @ezelbanaan (#4)
You can now specify SameSite attributes for session cookies; by default that's set to Lax. @tylersalminen #5
You can now customize nonce configuration per view / route. @tunetheweb (#6)
The length of the CSP nonce is now properly limited. @tunetheweb
Removed the legacy X-Content-Security-Policy header and its associated option, legacy_content_security_policy_header.