Install & Compatibility
Where this runs
tested against v1.1.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.000s · 17.9MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 1.6s · import 0.000s · 18MB
16MB installed
● package 16MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Talisman
✓ from flask_talisman import Talisman
✗ from flask_talisman import Talisman
This quickstart initializes a Flask application and applies default strict security headers using Flask-Talisman. The default configuration includes HTTPS enforcement (unless `debug=True`), HSTS, strict Content Security Policy, and more. [1, 2, 3]
from flask import Flask
from flask_talisman import Talisman
app = Flask(__name__)
# Initialize Talisman with default strict security headers
talisman = Talisman(app)
@app.route('/')
def hello():
return 'Hello, Secure World!'
if __name__ == '__main__':
# In production, ensure debug=False and serve over HTTPS
# For local development, you might need to adjust Talisman's force_https or debug settings
app.run(debug=True)
Debug
Known issues
deprecatedPython 2.x support was officially deprecated in v1.0.0. Ensure your application runs on Python 3.x.fixMigrate your application to Python 3.x to maintain compatibility and receive updates.
affects: >= 1.0.0
gotchaThe default Content Security Policy (CSP) is very strict (e.g., `default-src: 'self', 'object-src': 'none'`) and will block inline scripts/styles and external resources. This commonly breaks frontend frameworks or CDN-hosted assets. [1, 3, 5, 15]fixCustomize the `content_security_policy` and `content_security_policy_nonce_in` arguments when initializing `Talisman` to explicitly allow necessary sources or use nonces for inline content. Avoid `unsafe-inline` if possible. [15]
affects: All versions with default CSP
breakingThe `X-XSS-Protection` header is disabled by default starting from v1.1.0, aligning with browser deprecation of this header. This is a change in default behavior. [GitHub Release v1.1.0]fixNo direct fix needed as this is a security best practice change. Rely on a robust Content Security Policy instead of `X-XSS-Protection`.
affects: >= 1.1.0
gotchaFlask-Talisman is a fork of an earlier Google-maintained project that became unmaintained. While the current `wntrblm/flask-talisman` project is active, its history may be a consideration for long-term project stability. [5, 17]fixReview the project's GitHub activity and community engagement for ongoing viability if long-term critical reliance is anticipated.
affects: All versions
deprecatedPermissions Policy directives have changed: `interest-cohort` was removed in v1.0.0, and `browsing-topics` was added and disabled by default in v1.1.0. [GitHub Release v1.0.0, v1.1.0]fixReview your Permissions Policy configuration to remove deprecated directives and explicitly configure new privacy-related ones like `browsing-topics` if desired.
affects: >= 1.0.0
Upgrade
Version history
1.1.0latest on PyPI · released Aug 3, 2023
Audit
Dependencies
flaskrequiredCore web framework dependency for the extension.