Security meta issue

[sumanthratna]

https://flask.palletsprojects.com/en/2.0.x/security/

• force HTTPS, HSTS, only use cookies on secure connections, disable cookie access from JS, clickjacking prevention, XSS protection, CSP
  • https://github.com/GoogleCloudPlatform/flask-talisman
  • I think clickjacking prevention only works with sites that will never be embedded into an iframe
• set CORS on every single page
  • https://flask-cors.readthedocs.io/en/latest/
• use CSRF for every single form (admin signup, admin login, user form)
  • https://flask-seasurf.readthedocs.io/en/latest/
• settings: SESSION_COOKIE_SECURE, SESSION_COOKIE_SAMESITE, PREFERRED_URL_SCHEME,

[rau]

For CSRF, seasurf is no longer maintained - lets use Flask-WTF instead: https://flask-wtf.readthedocs.io/en/stable/csrf.html