owasp-flask
Drew DennisonRules for OWASP security checks for python
Run Locally
Rules (2)
semgrepRunning flask app with host 0.0.0.0 could expose the server publicly.
semgrepFound a Flask cookie with insecurely configured properties. By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.