jsonify doesn't accept a list

[kwellman]

I was suprised to find that jsonify(['hello', 'world']) will raise a TypeError even though

[
"hello",
"world"
]

is valid json.

I think there should be a check to see if the first argument is a list instance and just do a json dump of the first argument if it is or something like that.

[mitsuhiko]

It's there for security reasons: http://flask.pocoo.org/docs/security/#json-security

[adamjernst]

Can we have a way around this, perhaps a kwarg like allow_lists?

I'm building a backend API with Flask and the data is public and unauthenticated, so I don't need to worry about security in this case. I respect Flask's decision to be secure by default, but it would be nice to have a way around it.

[chrispaolini]

I'm not sure what the point of the restriction is. Someone could easily just hit users/1 users/2 users/3 and such and get the JSON from each individually. All this does is stop jsonify from being useful for lists.
Is there an alternative?

[apiguy]

Top level arrays are generally considered unsafe in json responses. Armin wrote an article about it once I believe: http://flask.pocoo.org/docs/security/#json-security

It's really not difficult to just do jsonify(results=my_list) and then in your javascript access it using data.results (or whatever your client language is)

[sigmavirus24]

If you're insistent on doing this, make your own response object, import the json module, dump your list as a string and fill the response object accordingly.

[chrispaolini]

I see. So just top-level have the issues. Fair enough. Thanks for the post apiguy

[untitaker]

Please continue discussion at #248