Flask Highlights Summary

Every highlight bullet from the 11 pages in this section, gathered on one page and grouped by the page it came from.

The Flask WSGI & Context Model

• Flask is a thin layer over Werkzeug, a WSGI toolkit - Flask itself is not the web server
• request, g, session, and current_app are proxies to context-local state, not real global objects
• Two contexts exist, not one: the app context and the request context, pushed and popped per request
• Blueprints group routes and static assets into the same app - they are not isolated sub-applications
• Flask 3's async def views bridge into the same sync WSGI worker model; they don't add native concurrency

Flask Basics

• Initialize Flask with Flask(name) to set package root
• Use @app.get or @app.post shortcuts to control HTTP methods
• Validate query arguments before passing them to SQL queries
• Validate JSON body data with Pydantic or marshmallow libraries
• Apply type converters in routes to validate URL parameters
• Register error handlers per status code for stable responses

Application Factories & Blueprints

• Factories delay Flask instance creation until configuration is known
• Isolate route handlers and static assets into separate blueprints
• Initialize Flask extensions with init_app inside the factory function
• Organize blueprint routes with url_prefix during blueprint registration
• Test multiple configurations by passing config values to create_app
• Build multi-blueprint applications by registering blueprints in factories

Extensions

• Module-level extension definition; init_app call in create_app factory
• Set SQLALCHEMY_DATABASE_URI in app.config before db.init_app
• Extensions store state on app.extensions, not module globals
• init_app pattern enables Flask application factory pattern
• Extensions like LoginManager follow the same init_app pattern
• Version pin extensions with Flask 3.1 for compatibility

Request Lifecycle & Context

• Use request context to isolate per-HTTP state with g locals
• Push app context for current_app access outside request handlers
• Load user headers in before_request hooks before handlers run
• Cleanup with teardown_request after each request completes
• Use g instead of mutable globals to avoid thread conflicts
• Request context automatically activates for each HTTP request

Templating with Jinja2

• Call render_template with variables to render HTML pages
• Template inheritance via blocks reduces duplication across files
• Jinja2 autoescapes HTML by default to prevent XSS
• Use url_for to generate correct URLs for routes and static files
• Keep template logic minimal; move complex logic to Python functions
• Jinja2 filters transform variables in templates without modifying them

Building REST APIs

• Validate JSON at request boundary with Pydantic ValidationError try/except blocks
• Return errors as JSON with 422 status using e.errors() on validation failure
• Use MethodView subclasses with get() and post() methods for class-based REST
• flask-smorest generates OpenAPI 3 documentation automatically from your views
• Return item.model_dump() with 201 status on successful JSON POST requests
• Item(BaseModel) with model_validate() ensures type safety for incoming JSON

Testing Flask

• Simulate HTTP requests in-process using test_client without a server
• Push app context to access current_app and route request data
• Isolate database tests with transaction fixtures that auto-rollback
• Create pytest fixtures that yield create_app with testing config
• Test auth flows and sessions by making requests to protected routes
• Assert route status codes to detect HTTP endpoint regressions

Deploying Flask

• Run Gunicorn with 4 workers behind a reverse proxy for Flask apps
• Set DEBUG = False, SESSION_COOKIE_SECURE = True in production
• Set PREFERRED_URL_SCHEME = https for proxy-backed deployments
• WSGI servers manage worker processes for zero-downtime deploys
• Terminate TLS at the reverse proxy, not the WSGI application
• Serve static files from CDN, not from the application server

Flask vs FastAPI vs Django

• Use FastAPI for async APIs with automatic OpenAPI documentation
• Django bundles admin panel, authentication, and ORM for full-stack development
• Flask provides minimal core and lets you choose extensions for your needs
• Choose FastAPI for APIs, Django for full-stack, Flask for microservices
• Select framework based on team skills, project type, and async needs

Flask Best Practices

• Use application factory and blueprints to structure Flask apps
• Validate JSON with Pydantic at the edge for type safety
• Store per-request data on g, never in module globals
• Never run SQLite with multiple concurrent workers
• Externalize all secrets to environment variables
• Return consistent error JSON shapes from all routes