Disabling flask-talisman by default #7535
Conversation
flask-talisman was enabled recently and while it may be virtuous in some cases, it seems to break things out of the box. Locally and in dev mode, upon my first redirect it sends to HTTPS and things it crashes. I think it should be opt-in, maybe we can recommend turning this on in production in the docs?
|
@mistercrunch is this in development or production? If you're in development then setting |
|
@john-bodley I was the person on Slack that @mistercrunch helped. With talisman defaulting to ON and trying to set up a production setup, and zero hints on how to do the TLS certificates, I pulled my hair out all day yesterday. Until/unless there is documentation on how to appease talisman's cert requirements, etc, I'd vote strongly for it being OFF by default, and strictly OPT-IN. |
|
I also have concerns about making certificates for a Docker container that will be deployed multiple times on differing hosts, and no easy way to inject the certificates at build time. |
|
Pretty sure I tested and got the same issue with |
flask-talisman was enabled recently and while it may be virtuous in some cases, it seems to break things out of the box. Locally and in dev mode, upon my first redirect it sends to HTTPS and things it crashes. I think it should be opt-in, maybe we can recommend turning this on in production in the docs? (cherry picked from commit 1fdc96a)
flask-talisman was enabled recently and while it may be virtuous in some cases, it seems to break things out of the box. Locally and in dev mode, upon my first redirect it sends to HTTPS and things it crashes. I think it should be opt-in, maybe we can recommend turning this on in production in the docs? (cherry picked from commit 1fdc96a)
mistercrunch
added
🏷️ bot
flask-talisman was enabled recently and while it may be virtuous in some cases, it seems to break things out of the box. Locally and in dev mode, upon my first redirect it sends to HTTPS and things it crashes. I think it should be opt-in, maybe we can recommend turning this on in production in the docs? (cherry picked from commit 42b28ff)
CATEGORY
Choose one
SUMMARY
flask-talisman was enabled recently and while it may be virtuous in some
cases, it seems to break things out of the box.
Locally and in dev mode, upon my first redirect it sends to HTTPS and
things it crashes.
I think it should be opt-in, maybe we can recommend turning this on in
production in the docs?
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF