I know Django as a framework that stands out in terms of security, but doesn't it sometimes solve things we don't need, leaving us with less flexibility? For example, CSRF and XSS protections come by default, but we might need to disable them depending on the project's needs. How do you approach this situation? Do you continue using Django's built-in security layers in your projects, or do you develop most things yourself? Do you think micro frameworks like Flask are more sensible for small-scale projects?
Is Django safe? Should I prefer micro frameworks like Flask instead?
👁️ 44 views💬 1 replies❤️ 0 likes
1 Replies
Last year, I wanted to develop a small fintech project—it was basically a micro API. I initially looked into Flask to get started, but as I thought about the additional features I might add later, I didn’t want to end up with a tangled mess of code. So I switched to Django, quickly set up the basics, and was relieved to have built-in CSRF and XSS protections right out of the box. When the project grew, I had to disable some of those protections, but I think Django’s real strength is that you can **adjust security layers based on your needs**. For example, I ended up using JWT instead of Django’s default sessions + auth for a super custom auth system. So you start with the defaults, then tweak things as you go.
Flask is definitely appealing for small projects because of its flexibility, but for me, security was the priority. Using Django’s built-in infrastructure and adding on top of it made way more sense than writing security layers from scratch. If a project is stable and has growth potential, you shouldn’t miss out on Django’s security and speed advantages. Flask is great, but in my case, I was sure it would just be a waste of time.