← Python

Flask (routing, blueprints, Jinja2, middleware)

← Flask (routing, blueprints, Jinja2, middleware)

Select a question from the sidebar

18 questions in this topic

Question 1 / 18

What is the Flask application factory pattern and why should you use it?

The application factory pattern creates the Flask app inside a function rather than as a module-level global. This function typically:

Creates the Flask instance
Loads configuration
Initializes extensions (db, login manager, etc.)
Registers blueprints
Returns the configured app

Why use it:

Testing: Create separate app instances with different configs (testing vs production)
Multiple instances: Run different configurations simultaneously
Circular imports: Avoids issues where extensions need the app at import time
Blueprints: Clean separation of concerns
Flask CLI: Works better with the flask command

Pseudo Code

def create_app(config=None):
    app = Flask(__name__)
    app.config.from_object(default_config)
    if config:
        app.config.update(config)
    init_extensions(app)
    register_blueprints(app)
    return app

Code

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate

# Extensions created without app (initialized later)
db = SQLAlchemy()
migrate = Migrate()

def create_app(config=None):
    """Application factory."""
    app = Flask(__name__)

    # Default configuration
    app.config.from_mapping(
        SECRET_KEY='dev-secret-key',
        SQLALCHEMY_DATABASE_URI='sqlite:///app.db',
        SQLALCHEMY_TRACK_MODIFICATIONS=False,
    )

    # Override with passed config (useful for testing)
    if config:
        app.config.update(config)

    # Initialize extensions with app
    db.init_app(app)
    migrate.init_app(app, db)

    # Register blueprints
    from .routes.auth import auth_bp
    from .routes.api import api_bp
    app.register_blueprint(auth_bp)
    app.register_blueprint(api_bp, url_prefix='/api')

    # Register error handlers
    @app.errorhandler(404)
    def not_found(error):
        return {'error': 'Not found'}, 404

    @app.errorhandler(500)
    def server_error(error):
        return {'error': 'Internal server error'}, 500

    return app

# Usage in production (wsgi.py or app.py)
app = create_app()

# Usage in tests
def test_config():
    app = create_app({
        'TESTING': True,
        'SQLALCHEMY_DATABASE_URI': 'sqlite:///:memory:',
    })
    assert app.config['TESTING'] is True

# Usage with Flask CLI
# In pyproject.toml or .flaskenv:
# FLASK_APP=mypackage:create_app

Key Points

•Create Flask app inside a function, not at module level
•Extensions are created globally but initialized with init_app() inside the factory
•Enables different configs for testing, development, production
•Avoids circular import issues

Gotchas

•Extensions must support the init_app pattern (most Flask extensions do)
•Importing the app directly from the module does not work -- use current_app instead
•Blueprint imports should be inside the factory to avoid circular imports
•Flask CLI needs FLASK_APP pointing to the factory function

The app factory creates the Flask app inside a function (create_app()), enabling different configs for testing/production, avoiding circular imports, and supporting multiple app instances.

•App created in a function, not at module level
•Different configs for different environments

from flask import Flask

def create_app(config=None):
    app = Flask(__name__)
    app.config['SECRET_KEY'] = 'dev'
    if config:
        app.config.update(config)
    # register blueprints, extensions...
    return app

# Test with different config
test_app = create_app({'TESTING': True})

Use current_app instead of importing the app instance directly

Question 2 / 18

How does Flask routing work, including URL parameters and HTTP methods?

Flask uses decorators to map URLs to view functions. The @app.route() decorator registers a URL rule with the app's URL map.

URL parameters:

<variable>: String by default
<int:id>: Integer converter
<float:value>: Float converter
<path:subpath>: Like string but accepts slashes
<uuid:item_id>: UUID converter

HTTP methods:

By default, routes only accept GET. Use methods=['GET', 'POST'] to accept multiple methods.

URL building:

url_for('function_name', **params) generates URLs from view function names, making code resilient to URL changes.

Pseudo Code

@app.route('/path/<type:variable>', methods=['GET', 'POST'])
def view_function(variable):
    if request.method == 'POST':
        # handle POST
    return response

Code

from flask import Flask, request, redirect, url_for, jsonify

app = Flask(__name__)

# Basic route
@app.route('/')
def index():
    return 'Hello, World!'

# URL parameters
@app.route('/user/<username>')
def show_user(username):
    return f'User: {username}'

# Type converters
@app.route('/post/<int:post_id>')
def show_post(post_id):
    return f'Post #{post_id}'

@app.route('/price/<float:amount>')
def show_price(amount):
    return f'Price: ${amount:.2f}'

@app.route('/files/<path:filepath>')
def serve_file(filepath):
    return f'File: {filepath}'  # filepath can contain slashes

# Multiple HTTP methods
@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        # authenticate...
        return redirect(url_for('index'))
    return '''<form method="post">
        <input name="username">
        <input name="password" type="password">
        <button>Login</button>
    </form>'''

# RESTful resource with multiple methods
@app.route('/api/items', methods=['GET', 'POST'])
def items():
    if request.method == 'GET':
        return jsonify({'items': []})
    elif request.method == 'POST':
        data = request.get_json()
        return jsonify(data), 201

@app.route('/api/items/<int:item_id>', methods=['GET', 'PUT', 'DELETE'])
def item_detail(item_id):
    if request.method == 'GET':
        return jsonify({'id': item_id})
    elif request.method == 'PUT':
        data = request.get_json()
        return jsonify(data)
    elif request.method == 'DELETE':
        return '', 204

# URL building with url_for
with app.test_request_context():
    print(url_for('index'))              # '/'
    print(url_for('show_user', username='alice'))  # '/user/alice'
    print(url_for('show_post', post_id=42))        # '/post/42'
    print(url_for('items'))              # '/api/items'

# Trailing slash behavior
@app.route('/about/')   # Accessible as /about/ AND /about (redirects)
def about(): return 'About'

@app.route('/contact')  # Accessible as /contact only. /contact/ returns 404
def contact(): return 'Contact'

/
/user/alice
/post/42
/api/items

Key Points

•@app.route() maps URLs to view functions with optional type converters
•methods parameter controls which HTTP methods are accepted
•url_for() builds URLs from function names, preventing hardcoded URLs
•Trailing slash in route means Flask redirects /path to /path/

Gotchas

•Routes without trailing slash return 404 for URLs with trailing slash
•url_for raises BuildError if the function name does not exist
•Order of route registration matters -- first match wins for ambiguous patterns
•request.get_json() returns None if Content-Type is not application/json

@app.route('/path/<type:var>') maps URLs to functions. Type converters: int, float, path, uuid. Use methods=['GET', 'POST'] for HTTP methods. url_for() builds URLs from function names.

•Type converters in angle brackets: <int:id>, <path:p>
•url_for('function_name') generates URLs safely

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/users/<int:user_id>', methods=['GET', 'PUT'])
def user(user_id):
    if request.method == 'GET':
        return jsonify({'id': user_id})
    data = request.get_json()
    return jsonify(data)

request.get_json() returns None without Content-Type: application/json

Question 3 / 18

What are Flask blueprints and how do they help organize larger applications?

A Blueprint is a way to organize related routes, templates, and static files into reusable modules. Think of it as a mini-application that gets registered on the main Flask app.

Benefits:

Modularity: Split a large app into logical components (auth, api, admin)
Reusability: Same blueprint can be registered on multiple apps
URL prefixing: Each blueprint can have its own URL prefix
Template/static overriding: Each blueprint can have its own templates folder

Common patterns:

Feature-based: auth_bp, api_bp, admin_bp
API versioning: /api/v1/..., /api/v2/...
Plugin systems: register third-party blueprints

Pseudo Code

# In auth/routes.py:
auth_bp = Blueprint('auth', __name__)

@auth_bp.route('/login')
def login(): ...

# In app factory:
app.register_blueprint(auth_bp, url_prefix='/auth')
# Result: /auth/login

Code

from flask import Flask, Blueprint, render_template, jsonify, request

# Blueprint for authentication
auth_bp = Blueprint('auth', __name__,
                    template_folder='templates/auth',
                    url_prefix='/auth')

@auth_bp.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        return jsonify({'message': 'Logged in'})
    return '<form method="post"><button>Login</button></form>'

@auth_bp.route('/logout')
def logout():
    return jsonify({'message': 'Logged out'})

# Blueprint for API
api_bp = Blueprint('api', __name__, url_prefix='/api/v1')

@api_bp.route('/users')
def list_users():
    return jsonify({'users': []})

@api_bp.route('/users/<int:user_id>')
def get_user(user_id):
    return jsonify({'id': user_id})

# Blueprint-specific error handler
@api_bp.errorhandler(404)
def api_not_found(error):
    return jsonify({'error': 'API resource not found'}), 404

# Blueprint-level before_request
@api_bp.before_request
def require_api_key():
    if not request.headers.get('X-API-Key'):
        return jsonify({'error': 'API key required'}), 401

# Admin blueprint
admin_bp = Blueprint('admin', __name__,
                     url_prefix='/admin',
                     static_folder='admin_static')

@admin_bp.route('/dashboard')
def dashboard():
    return 'Admin Dashboard'

# App factory with blueprint registration
def create_app():
    app = Flask(__name__)
    app.config['SECRET_KEY'] = 'dev'

    # Register blueprints
    app.register_blueprint(auth_bp)
    app.register_blueprint(api_bp)
    app.register_blueprint(admin_bp)

    return app

# URL building with blueprints
app = create_app()
with app.test_request_context():
    from flask import url_for
    print(url_for('auth.login'))       # /auth/login
    print(url_for('api.list_users'))   # /api/v1/users
    print(url_for('admin.dashboard'))  # /admin/dashboard

# Nested blueprints (Flask 2.0+)
parent_bp = Blueprint('parent', __name__, url_prefix='/parent')
child_bp = Blueprint('child', __name__, url_prefix='/child')

@child_bp.route('/hello')
def child_hello():
    return 'Hello from child'

parent_bp.register_blueprint(child_bp)
# URL: /parent/child/hello

/auth/login
/api/v1/users
/admin/dashboard

Key Points

•Blueprints group related routes into reusable modules
•url_prefix adds a prefix to all routes in the blueprint
•Blueprint-specific before_request and errorhandler only apply to that blueprint
•url_for('blueprint_name.function_name') to reference blueprint routes

Gotchas

•Blueprint names must be unique -- duplicate names cause errors at registration
•url_for requires 'blueprint_name.endpoint' syntax for blueprint routes
•Blueprint templates can shadow app-level templates of the same name
•before_request on a blueprint only runs for that blueprint's routes

Blueprints are modular components grouping related routes. Create with Blueprint('name', __name__), register with app.register_blueprint(bp, url_prefix='/prefix'). Reference with url_for('bp.endpoint').

•Group related routes into reusable modules
•url_prefix adds a prefix to all blueprint routes

from flask import Blueprint, jsonify

api_bp = Blueprint('api', __name__, url_prefix='/api')

@api_bp.route('/users')
def list_users():
    return jsonify({'users': []})

# In app factory:
# app.register_blueprint(api_bp)

Blueprint names must be unique across the app

Question 4 / 18

How do Jinja2 template filters, macros, and inheritance work in Flask?

Jinja2 is Flask's default template engine. Three powerful features:

Template Inheritance

Base templates define blocks that child templates override. This creates a consistent layout across pages.

Filters

Transform variables in templates: {{ value|filter }}. Custom filters can be registered.

Macros

Reusable template functions. Like Python functions but for HTML. Defined with {% macro name(args) %}.

Pseudo Code

Inheritance:
  base.html:  {% block content %}{% endblock %}
  child.html: {% extends 'base.html' %}
              {% block content %}My content{% endblock %}

Filters:
  {{ name|upper }}         -> "ALICE"
  {{ list|join(', ') }}    -> "a, b, c"
  {{ text|truncate(50) }}  -> "Long text..."

Macros:
  {% macro input(name, type='text') %}
    <input type="{{ type }}" name="{{ name }}">
  {% endmacro %}
  {{ input('email', 'email') }}

Code

from flask import Flask, render_template_string

app = Flask(__name__)

# Template Inheritance Example
base_template = '''
<!DOCTYPE html>
<html>
<head><title>{% block title %}Default{% endblock %}</title></head>
<body>
  <nav>Navigation Bar</nav>
  <main>
    {% block content %}{% endblock %}
  </main>
  <footer>{% block footer %}Default Footer{% endblock %}</footer>
</body>
</html>
'''

child_template = '''
{% extends "base.html" %}
{% block title %}Home Page{% endblock %}
{% block content %}
  <h1>Welcome, {{ user.name }}!</h1>
  <p>{{ user.bio|truncate(100) }}</p>
{% endblock %}
{# footer block not overridden -- uses default #}
'''

# Custom Filters
@app.template_filter('currency')
def currency_filter(value):
    """Format a number as currency."""
    return f"${value:,.2f}"

@app.template_filter('timeago')
def timeago_filter(dt):
    """Convert datetime to relative time string."""
    from datetime import datetime
    diff = datetime.utcnow() - dt
    if diff.days > 0:
        return f"{diff.days}d ago"
    hours = diff.seconds // 3600
    if hours > 0:
        return f"{hours}h ago"
    return f"{diff.seconds // 60}m ago"

# Usage in template:
# {{ price|currency }}        -> "$1,234.56"
# {{ created_at|timeago }}    -> "3h ago"

# Macros Example
macro_template = '''
{# Define macros #}
{% macro form_field(name, label, type="text", required=false) %}
  <div class="field">
    <label for="{{ name }}">{{ label }}</label>
    <input type="{{ type }}" name="{{ name }}" id="{{ name }}"
           {% if required %}required{% endif %}>
  </div>
{% endmacro %}

{% macro alert(message, type="info") %}
  <div class="alert alert-{{ type }}">
    {{ message }}
  </div>
{% endmacro %}

{# Use macros #}
<form>
  {{ form_field("username", "Username", required=true) }}
  {{ form_field("email", "Email", type="email", required=true) }}
  {{ form_field("bio", "Bio") }}
  <button>Submit</button>
</form>

{{ alert("Profile updated!", "success") }}
'''

# Import macros from another file
import_template = '''
{% from "macros.html" import form_field, alert %}

<form>
  {{ form_field("name", "Name") }}
</form>
'''

# Built-in filters
filter_examples = '''
{{ "hello world"|title }}           {# Hello World #}
{{ "hello"|upper }}                 {# HELLO #}
{{ [1,2,3]|join(", ") }}            {# 1, 2, 3 #}
{{ "<script>"|e }}                  {# &lt;script&gt; (escaped) #}
{{ users|length }}                  {# number of users #}
{{ users|selectattr("active")|list }} {# filter active users #}
{{ items|sort(attribute="name") }}  {# sort by attribute #}
{{ value|default("N/A") }}          {# default if undefined #}
{{ text|truncate(50, true, "...") }} {# truncate with ellipsis #}
{{ dict|tojson }}                   {# convert to JSON string #}
'''

@app.route('/')
def index():
    return render_template_string(macro_template)

Key Points

•Template inheritance: base defines blocks, children override them
•Filters transform values: {{ val|filter }}, custom with @app.template_filter
•Macros are reusable template functions, importable across files
•Built-in filters: truncate, join, sort, default, tojson, length

Gotchas

•Jinja2 auto-escapes HTML by default -- use |safe only for trusted content
•Macros imported with {% from %} are not available in child template blocks by default
•Template inheritance only works with {% extends %} as the first tag in the file
•Custom filters must be registered before the template is rendered

Inheritance: {% extends 'base.html' %} + {% block name %}. Filters: {{ val|upper }}, custom with @app.template_filter. Macros: {% macro name(args) %}...{% endmacro %}, import with {% from 'file' import macro %}.

•Inheritance for layout, filters for data, macros for reusable HTML
•@app.template_filter to register custom filters

# Custom filter
@app.template_filter('currency')
def currency(value):
    return f"${value:,.2f}"

# In template: {{ 1234.5|currency }} -> $1,234.50
# Macro: {% macro btn(text) %}<button>{{ text }}</button>{% endmacro %}

Jinja2 auto-escapes HTML -- use |safe only for trusted content

Question 5 / 18

How do Flask request and response objects work?

The `request` object

A thread-local proxy to the current request. Contains all data about the incoming HTTP request.

Key `request` attributes:

request.method -- HTTP method (GET, POST, etc.)
request.args -- URL query parameters (GET)
request.form -- Form data (POST)
request.json / request.get_json() -- JSON body
request.files -- Uploaded files
request.headers -- HTTP headers
request.cookies -- Cookies
request.path -- URL path
request.url -- Full URL

The `response` object

View functions can return:

A string (becomes response body)
A tuple (body, status_code) or (body, status_code, headers)
A Response object
A dict (auto-converted to JSON in Flask 2.x+)

make_response() creates a Response object for customization.

Pseudo Code

Request data access:
  GET /search?q=python  -> request.args.get('q') = 'python'
  POST form data        -> request.form.get('field')
  POST JSON body        -> request.get_json()['key']
  File upload           -> request.files['file']

Response creation:
  return 'text'                    -> 200 OK, text/html
  return {'key': 'val'}            -> 200 OK, application/json
  return 'text', 201               -> 201 Created
  return 'text', 201, {'X-Custom': 'val'}  -> with headers

Code

from flask import Flask, request, make_response, jsonify, redirect, url_for

app = Flask(__name__)

# Accessing request data
@app.route('/search')
def search():
    query = request.args.get('q', '')  # GET parameter
    page = request.args.get('page', 1, type=int)
    return jsonify({'query': query, 'page': page})

@app.route('/submit', methods=['POST'])
def submit():
    # Form data (application/x-www-form-urlencoded or multipart/form-data)
    name = request.form.get('name')
    email = request.form.get('email')

    # JSON body (application/json)
    data = request.get_json(silent=True)  # silent=True returns None on failure

    # Headers
    auth = request.headers.get('Authorization')
    content_type = request.content_type

    return jsonify({
        'name': name,
        'email': email,
        'json_data': data,
        'auth_header': auth,
    })

# File upload
@app.route('/upload', methods=['POST'])
def upload():
    if 'file' not in request.files:
        return jsonify({'error': 'No file uploaded'}), 400

    file = request.files['file']
    if file.filename == '':
        return jsonify({'error': 'No file selected'}), 400

    # file.save('/path/to/uploads/' + file.filename)
    return jsonify({
        'filename': file.filename,
        'content_type': file.content_type,
        'size': file.content_length,
    })

# Response creation methods
@app.route('/text')
def text_response():
    return 'Hello World'  # 200, text/html

@app.route('/json')
def json_response():
    return {'message': 'Hello'}  # auto-JSON in Flask 2.x+

@app.route('/custom')
def custom_response():
    response = make_response('Custom body', 201)
    response.headers['X-Custom-Header'] = 'value'
    response.set_cookie('session_id', 'abc123', httponly=True, samesite='Lax')
    return response

@app.route('/redirect-example')
def redirect_example():
    return redirect(url_for('search', q='flask'))

# Tuple responses
@app.route('/tuple')
def tuple_response():
    return 'Created', 201, {'Location': '/items/1'}

# Accessing various request properties
@app.route('/info')
def request_info():
    return jsonify({
        'method': request.method,
        'url': request.url,
        'path': request.path,
        'remote_addr': request.remote_addr,
        'user_agent': str(request.user_agent),
        'is_json': request.is_json,
        'cookies': dict(request.cookies),
    })

Key Points

•request is a thread-local proxy with args, form, json, files, headers
•Views can return strings, dicts (auto-JSON), tuples, or Response objects
•make_response() for customizing headers, cookies, status codes
•request.get_json(silent=True) returns None on parse failure instead of 400

Gotchas

•request.json raises 400 if body is not valid JSON; use get_json(silent=True)
•request.form and request.args are MultiDict -- getlist() for multiple values
•request is only available inside a request context (view function or with app.test_request_context())
•Returning a dict as JSON only works in Flask 2.0+; use jsonify() for older versions

request provides access to query params (.args), form data (.form), JSON (.get_json()), files, headers, cookies. Views return strings, dicts (auto-JSON), tuples (body, status, headers), or Response objects.

•request.args (GET), request.form (POST), request.get_json() (JSON)
•Return dict for JSON, tuple for status + headers

from flask import request, jsonify, make_response

@app.route('/api', methods=['POST'])
def api():
    data = request.get_json()
    name = request.args.get('name', 'default')
    resp = make_response(jsonify({'ok': True}), 201)
    resp.headers['X-Custom'] = 'value'
    return resp

request.get_json() needs Content-Type: application/json header

Question 6 / 18

How do before_request and after_request hooks work in Flask?

Flask provides request lifecycle hooks that run code before and after each request:

Hooks (in execution order):

before_request: Runs before each request. If it returns a response, the view is skipped.
View function: The matched route handler
after_request(response): Runs after each request. Must return a response.
teardown_request(exception): Runs after response is sent. For cleanup. Called even on errors.

Additional hooks:

before_first_request (deprecated in Flask 2.3): Runs only once on first request
teardown_appcontext: Cleanup when app context is popped

Blueprint-specific hooks only apply to that blueprint's routes.

Pseudo Code

Request lifecycle:
  before_request_1()
  before_request_2()
  |-> if any returns response, skip view
  view_function()
  after_request_1(response)
  after_request_2(response)
  teardown_request(exception)  # always runs

Code

from flask import Flask, request, g, jsonify
import time

app = Flask(__name__)

# before_request: runs before every request
@app.before_request
def log_request():
    g.start_time = time.perf_counter()  # g is per-request storage
    print(f"Request: {request.method} {request.path}")

@app.before_request
def check_auth():
    """Authenticate requests. Return response to short-circuit."""
    public_paths = ['/', '/health', '/login']
    if request.path in public_paths:
        return None  # continue to view

    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'error': 'Unauthorized'}), 401  # skip view!

    g.user = {'id': 1, 'name': 'Alice'}  # store user in g

# after_request: modify response, add headers
@app.after_request
def add_timing_header(response):
    if hasattr(g, 'start_time'):
        elapsed = time.perf_counter() - g.start_time
        response.headers['X-Response-Time'] = f"{elapsed:.4f}s"
    return response  # MUST return response

@app.after_request
def add_security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    return response

# teardown_request: cleanup, always runs
@app.teardown_request
def cleanup(exception):
    if exception:
        print(f"Request failed: {exception}")
    # Close database connections, etc.

# Routes
@app.route('/')
def index():
    return 'Public page'

@app.route('/api/data')
def api_data():
    return jsonify({'user': g.user, 'data': [1, 2, 3]})

@app.route('/health')
def health():
    return jsonify({'status': 'ok'})

# Blueprint-specific hooks
from flask import Blueprint

admin_bp = Blueprint('admin', __name__, url_prefix='/admin')

@admin_bp.before_request
def admin_auth():
    """Only runs for admin blueprint routes."""
    if not getattr(g, 'user', {}).get('is_admin'):
        return jsonify({'error': 'Admin access required'}), 403

@admin_bp.route('/dashboard')
def dashboard():
    return jsonify({'admin': True})

app.register_blueprint(admin_bp)

Key Points

•before_request can short-circuit by returning a response (skips view)
•after_request receives and must return the response object
•teardown_request always runs, even on errors -- for cleanup
•g object stores per-request data accessible across hooks and views

Gotchas

•after_request must return the response -- forgetting this causes 500 errors
•after_request does NOT run if an unhandled exception occurs -- use teardown_request for guaranteed cleanup
•Blueprint before_request only runs for that blueprint's routes, not all routes
•g is reset between requests -- do not use it for persistent state

before_request runs before every view (return a response to skip the view). after_request(response) modifies the response (must return it). teardown_request always runs for cleanup. g stores per-request data.

•before_request for auth checks; after_request for headers
•after_request MUST return the response object

from flask import g, request
import time

@app.before_request
def before():
    g.start = time.time()

@app.after_request
def after(response):
    response.headers['X-Time'] = str(time.time() - g.start)
    return response  # must return!

after_request does not run on unhandled exceptions

Question 7 / 18

How do sessions and cookies work in Flask?

Cookies

Flask can set and read cookies using response.set_cookie() and request.cookies.

Sessions

Flask sessions are client-side by default -- stored as a signed cookie. The data is serialized, signed with SECRET_KEY, and sent to the client. The client cannot tamper with it (the signature would break), but they CAN read it.

Session storage:

Default: Signed cookie (client-side). Limited to ~4KB.
Server-side: Use Flask-Session extension for Redis, filesystem, database backends.

Security considerations:

Always set a strong SECRET_KEY (used to sign session cookies)
Use httponly=True to prevent JavaScript access
Use secure=True for HTTPS-only
Use samesite='Lax' or 'Strict' for CSRF protection

Pseudo Code

# Session (signed cookie)
session['user_id'] = 42      # set
user_id = session.get('user_id')  # get
session.pop('user_id', None)     # remove

# Cookie (plain)
resp.set_cookie('key', 'value', httponly=True)
value = request.cookies.get('key')

Code

from flask import Flask, session, request, make_response, redirect, url_for, jsonify

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key-change-in-production'
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'

# Session usage
@app.route('/login', methods=['POST'])
def login():
    data = request.get_json()
    # Validate credentials...
    session['user_id'] = 1
    session['username'] = data.get('username', 'guest')
    session.permanent = True  # session lasts beyond browser close
    return jsonify({'message': 'Logged in'})

@app.route('/profile')
def profile():
    if 'user_id' not in session:
        return jsonify({'error': 'Not logged in'}), 401
    return jsonify({
        'user_id': session['user_id'],
        'username': session.get('username'),
    })

@app.route('/logout')
def logout():
    session.clear()  # remove all session data
    return jsonify({'message': 'Logged out'})

# Cookie usage
@app.route('/set-preference')
def set_preference():
    theme = request.args.get('theme', 'light')
    response = make_response(jsonify({'theme': theme}))
    response.set_cookie(
        'theme',
        theme,
        max_age=60 * 60 * 24 * 365,  # 1 year
        httponly=True,
        secure=False,  # True in production (HTTPS only)
        samesite='Lax',
    )
    return response

@app.route('/get-preference')
def get_preference():
    theme = request.cookies.get('theme', 'light')
    return jsonify({'theme': theme})

@app.route('/delete-preference')
def delete_preference():
    response = make_response(jsonify({'message': 'Preference deleted'}))
    response.delete_cookie('theme')
    return response

# Session configuration options
app.config.update(
    SESSION_COOKIE_NAME='myapp_session',
    PERMANENT_SESSION_LIFETIME=3600,  # 1 hour for permanent sessions
    SESSION_COOKIE_SECURE=True,  # HTTPS only
    SESSION_COOKIE_HTTPONLY=True,  # no JS access
    SESSION_COOKIE_SAMESITE='Lax',  # CSRF protection
)

Key Points

•Sessions are signed cookies by default -- tamper-proof but client-readable
•SECRET_KEY signs the session cookie -- must be strong and secret
•session.permanent = True makes sessions survive browser close
•Cookies need httponly, secure, and samesite for security

Gotchas

•Default sessions are client-side (cookie) -- limited to ~4KB
•Session data is readable by the client (just signed, not encrypted)
•Changing SECRET_KEY invalidates all existing sessions
•session.modified must be set to True if you mutate a mutable object in session (e.g., session['list'].append(x))

Flask sessions are signed cookies (tamper-proof, client-readable). Use session['key'] = value to set, session.get('key') to read. Cookies: response.set_cookie(name, value, httponly=True). Always set a strong SECRET_KEY.

•session uses signed cookies; SECRET_KEY required
•Cookies need httponly=True and samesite='Lax'

from flask import session, request, make_response

@app.route('/login', methods=['POST'])
def login():
    session['user_id'] = 1  # stored in signed cookie
    return 'OK'

@app.route('/check')
def check():
    user_id = session.get('user_id')  # read from cookie
    theme = request.cookies.get('theme', 'light')  # plain cookie

Session data is signed but NOT encrypted -- client can read it

Question 8 / 18

How do you handle errors and create custom error pages in Flask?

Flask provides @app.errorhandler() to register custom error handlers for HTTP status codes and exceptions.

Error handling approaches:

@app.errorhandler(404) -- handle specific HTTP status codes
@app.errorhandler(Exception) -- catch-all for unhandled exceptions
abort(status_code) -- raise HTTP errors from view functions
@app.errorhandler(CustomException) -- handle custom exception classes

Error handlers can return HTML (for web apps) or JSON (for APIs).

Pseudo Code

@app.errorhandler(404)
def not_found(error):
    if wants_json(request):
        return jsonify({'error': 'Not found'}), 404
    return render_template('404.html'), 404

abort(403)  # raises 403 Forbidden from any view

Code

from flask import Flask, jsonify, render_template_string, request
from werkzeug.exceptions import HTTPException

app = Flask(__name__)

# Custom exception
class APIError(Exception):
    def __init__(self, message, status_code=400, payload=None):
        super().__init__()
        self.message = message
        self.status_code = status_code
        self.payload = payload

    def to_dict(self):
        rv = dict(self.payload or {})
        rv['error'] = self.message
        return rv

# Register error handlers
@app.errorhandler(404)
def not_found(error):
    if request.path.startswith('/api/'):
        return jsonify({'error': 'Resource not found'}), 404
    return render_template_string(
        '<h1>404 - Page Not Found</h1><p>{{ message }}</p>',
        message=str(error)
    ), 404

@app.errorhandler(500)
def server_error(error):
    return jsonify({'error': 'Internal server error'}), 500

@app.errorhandler(405)
def method_not_allowed(error):
    return jsonify({
        'error': 'Method not allowed',
        'allowed': error.valid_methods
    }), 405

# Handle custom exception
@app.errorhandler(APIError)
def handle_api_error(error):
    response = jsonify(error.to_dict())
    response.status_code = error.status_code
    return response

# Catch-all for unhandled exceptions
@app.errorhandler(Exception)
def handle_unexpected_error(error):
    if isinstance(error, HTTPException):
        return error  # let HTTP errors pass through
    # Log the error
    app.logger.error(f"Unexpected error: {error}", exc_info=True)
    return jsonify({'error': 'An unexpected error occurred'}), 500

# Using abort and custom exceptions in views
from flask import abort

@app.route('/api/users/<int:user_id>')
def get_user(user_id):
    if user_id > 100:
        abort(404)  # raises werkzeug NotFound exception

    if user_id == 0:
        raise APIError('Invalid user ID', status_code=400)

    return jsonify({'id': user_id, 'name': 'Alice'})

@app.route('/api/protected')
def protected():
    token = request.headers.get('Authorization')
    if not token:
        raise APIError('Authentication required', status_code=401)
    if token != 'Bearer valid-token':
        raise APIError('Invalid token', status_code=403,
                       payload={'hint': 'Check your API key'})
    return jsonify({'data': 'secret'})

Key Points

•@app.errorhandler handles specific HTTP codes or exception types
•abort(code) raises HTTP errors from within view functions
•Custom exception classes for structured API error responses
•Error handlers can return HTML or JSON based on request context

Gotchas

•Error handlers must return a response (or tuple) -- returning None causes 500
•The catch-all Exception handler should check for HTTPException to not swallow them
•In debug mode, Flask shows its own error page for 500 errors, hiding your handler
•abort() raises werkzeug.exceptions.HTTPException subclasses, not generic exceptions

@app.errorhandler(404) registers a handler for HTTP 404. abort(code) raises HTTP errors. Custom exception classes with their own handlers create structured API errors.

•@app.errorhandler for status codes and exception classes
•abort(code) to raise HTTP errors from views

from flask import abort, jsonify

@app.errorhandler(404)
def not_found(e):
    return jsonify({'error': 'Not found'}), 404

@app.route('/users/<int:uid>')
def get_user(uid):
    if uid > 100:
        abort(404)

In debug mode, Flask's debugger overrides your 500 handler

Question 9 / 18

What is the difference between Flask's application context and request context?

Flask uses two contexts implemented as thread-local stacks:

Application Context

Contains: current_app (the Flask app) and g (per-request storage)
Pushed: When a request starts, or manually with app.app_context()
Use case: Accessing app config, database connections outside of requests

Request Context

Contains: request (incoming HTTP data) and session (user session)
Pushed: Automatically when Flask handles a request
Pushing request context also pushes application context

When you need to manually push contexts:

In CLI commands
In background tasks/workers
In tests
In interactive shell

Pseudo Code

Application Context:
  current_app -> the Flask app instance
  g -> per-request storage (reset each request)

Request Context:
  request -> incoming HTTP request data
  session -> user session data

With request context:
  both contexts are available
With only app context:
  only current_app and g are available

Code

from flask import Flask, current_app, g, request, session

app = Flask(__name__)
app.config['SECRET_KEY'] = 'dev'
app.config['DATABASE_URI'] = 'sqlite:///app.db'

# Inside a view -- both contexts available
@app.route('/')
def index():
    # Application context
    db_uri = current_app.config['DATABASE_URI']
    g.user = 'Alice'

    # Request context
    method = request.method
    user_agent = request.user_agent.string

    return f'DB: {db_uri}, Method: {method}'

# Manually pushing application context
def init_database():
    """Called from CLI or script -- no request context."""
    with app.app_context():
        db_uri = current_app.config['DATABASE_URI']
        print(f"Initializing DB: {db_uri}")
        # current_app works here, but request does NOT

init_database()

# Manually pushing request context (for testing)
def test_example():
    with app.test_request_context('/test?name=Alice',
                                   method='POST',
                                   data={'key': 'value'}):
        # Both contexts available
        print(request.args.get('name'))  # Alice
        print(request.method)  # POST
        print(current_app.name)  # app name

test_example()

# Error: using request outside context
try:
    print(request.method)  # RuntimeError!
except RuntimeError as e:
    print(f"Error: {e}")
    # "Working outside of request context"

# Common pattern: CLI command
@app.cli.command()
def seed_db():
    """Flask CLI commands have app context automatically."""
    db_uri = current_app.config['DATABASE_URI']
    print(f"Seeding database: {db_uri}")

# Background task pattern
def send_email_task(app, user_email):
    """Background task needs its own app context."""
    with app.app_context():
        # current_app works here
        sender = current_app.config.get('MAIL_SENDER')
        print(f"Sending from {sender} to {user_email}")

# g object lifespan
@app.before_request
def load_user():
    g.user = 'loaded from DB'  # available in view and after_request

@app.route('/profile')
def profile():
    return f'User: {g.user}'

@app.teardown_appcontext
def close_db(exception):
    """Clean up when app context is popped."""
    db = g.pop('db_connection', None)
    if db is not None:
        db.close()

Initializing DB: sqlite:///app.db
Alice
POST
__main__
Error: Working outside of request context.

Key Points

•Application context: current_app + g (config, per-request storage)
•Request context: request + session (HTTP data, user session)
•Request context automatically pushes app context
•CLI commands, background tasks, and tests need manual context pushing

Gotchas

•Accessing request/session outside a request context raises RuntimeError
•g is reset between requests -- do not use for persistent storage
•Forgetting to push app context in background tasks causes 'working outside of application context' errors
•current_app is a proxy -- don't store it; it changes with context

App context: current_app + g (config, per-request storage). Request context: request + session (HTTP data). Request context auto-includes app context. CLI commands/tests need with app.app_context():.

•App context: current_app, g. Request context: request, session
•Use with app.app_context() outside of requests

from flask import Flask, current_app

app = Flask(__name__)
app.config['DB'] = 'sqlite:///app.db'

# Outside request: manually push context
with app.app_context():
    print(current_app.config['DB'])  # works

# Inside view: both contexts available automatically
@app.route('/')
def index():
    return current_app.config['DB']

sqlite:///app.db

Accessing request outside request context raises RuntimeError

Question 10 / 18

How do you test Flask applications?

Flask provides built-in testing support with app.test_client() which simulates HTTP requests without running a real server.

Key testing tools:

app.test_client(): Makes HTTP requests to the app
app.test_request_context(): Creates a request context for unit testing
TESTING=True config: Disables error catching for better tracebacks

With pytest:

Use fixtures for app, client, and database setup
conftest.py for shared fixtures
Each test gets its own database transaction (rolled back after test)

Pseudo Code

@pytest.fixture
def app():
    app = create_app({'TESTING': True})
    yield app

@pytest.fixture
def client(app):
    return app.test_client()

def test_home(client):
    response = client.get('/')
    assert response.status_code == 200

Code

import pytest
from flask import Flask, jsonify, request

# Application to test
def create_app(config=None):
    app = Flask(__name__)
    app.config['SECRET_KEY'] = 'test'
    if config:
        app.config.update(config)

    @app.route('/')
    def index():
        return jsonify({'message': 'Hello'})

    @app.route('/api/items', methods=['GET', 'POST'])
    def items():
        if request.method == 'POST':
            data = request.get_json()
            return jsonify(data), 201
        return jsonify({'items': []})

    @app.route('/api/items/<int:item_id>')
    def item_detail(item_id):
        if item_id > 100:
            return jsonify({'error': 'Not found'}), 404
        return jsonify({'id': item_id})

    return app

# conftest.py fixtures
@pytest.fixture
def app():
    app = create_app({'TESTING': True})
    yield app

@pytest.fixture
def client(app):
    return app.test_client()

@pytest.fixture
def runner(app):
    return app.test_cli_runner()

# Test cases
def test_index(client):
    response = client.get('/')
    assert response.status_code == 200
    data = response.get_json()
    assert data['message'] == 'Hello'

def test_get_items(client):
    response = client.get('/api/items')
    assert response.status_code == 200
    assert 'items' in response.get_json()

def test_create_item(client):
    response = client.post('/api/items',
                           json={'name': 'Test Item', 'price': 9.99})
    assert response.status_code == 201
    data = response.get_json()
    assert data['name'] == 'Test Item'

def test_get_item(client):
    response = client.get('/api/items/1')
    assert response.status_code == 200
    assert response.get_json()['id'] == 1

def test_item_not_found(client):
    response = client.get('/api/items/999')
    assert response.status_code == 404

# Testing with authentication
def test_with_headers(client):
    response = client.get('/api/items',
                          headers={'Authorization': 'Bearer token123'})
    assert response.status_code == 200

# Testing sessions
def test_session(client):
    with client.session_transaction() as sess:
        sess['user_id'] = 1  # set session before request

    response = client.get('/profile')
    # session is now set for this request

# Testing forms
def test_form_submission(client):
    response = client.post('/login',
                           data={'username': 'alice', 'password': 'secret'},
                           follow_redirects=True)
    assert response.status_code == 200

# Testing file uploads
import io

def test_file_upload(client):
    data = {
        'file': (io.BytesIO(b'file content'), 'test.txt'),
    }
    response = client.post('/upload',
                           data=data,
                           content_type='multipart/form-data')
    assert response.status_code == 200

Key Points

•app.test_client() simulates HTTP requests without a real server
•response.get_json() parses JSON response body
•json= parameter sends JSON with correct Content-Type
•session_transaction() context manager sets session data for testing

Gotchas

•TESTING=True disables error catching -- exceptions propagate to the test
•client.get/post returns a Response, not the view's return value
•follow_redirects=False by default -- set True to follow redirect chains
•File uploads need content_type='multipart/form-data'

Use app.test_client() to make HTTP requests in tests. response.get_json() parses JSON. Use json= for POST data. Test sessions with client.session_transaction().

•test_client() for HTTP simulation
•json= for sending JSON data

import pytest

@pytest.fixture
def client():
    app = create_app({'TESTING': True})
    return app.test_client()

def test_api(client):
    resp = client.post('/api/items', json={'name': 'test'})
    assert resp.status_code == 201
    assert resp.get_json()['name'] == 'test'

follow_redirects defaults to False

Question 11 / 18

How does Flask-SQLAlchemy integrate with Flask?

Flask-SQLAlchemy is an extension that integrates SQLAlchemy ORM with Flask. It simplifies database setup, model definition, and session management.

Key features:

Automatic session management tied to request lifecycle
db.Model base class for defining models
db.session for queries and transactions
Integration with Flask's app factory pattern via db.init_app(app)
Automatic table creation with db.create_all()

Pseudo Code

db = SQLAlchemy()

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(100))

# In app factory:
db.init_app(app)

# Query:
User.query.filter_by(name='Alice').first()
db.session.add(user)
db.session.commit()

Code

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from datetime import datetime

db = SQLAlchemy()

# Model definitions
class User(db.Model):
    __tablename__ = 'users'

    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    posts = db.relationship('Post', backref='author', lazy='dynamic')

    def __repr__(self):
        return f'<User {self.username}>'

    def to_dict(self):
        return {
            'id': self.id,
            'username': self.username,
            'email': self.email,
            'created_at': self.created_at.isoformat(),
        }

class Post(db.Model):
    __tablename__ = 'posts'

    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(200), nullable=False)
    body = db.Column(db.Text)
    user_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)

# App factory
def create_app():
    app = Flask(__name__)
    app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///app.db'
    app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
    db.init_app(app)
    return app

# CRUD operations in views
from flask import jsonify, request

app = create_app()

@app.route('/api/users', methods=['GET'])
def list_users():
    users = User.query.all()
    return jsonify([u.to_dict() for u in users])

@app.route('/api/users', methods=['POST'])
def create_user():
    data = request.get_json()
    user = User(username=data['username'], email=data['email'])
    db.session.add(user)
    db.session.commit()
    return jsonify(user.to_dict()), 201

@app.route('/api/users/<int:user_id>')
def get_user(user_id):
    user = db.session.get(User, user_id)  # SQLAlchemy 2.0 style
    if not user:
        return jsonify({'error': 'Not found'}), 404
    return jsonify(user.to_dict())

@app.route('/api/users/<int:user_id>', methods=['PUT'])
def update_user(user_id):
    user = db.session.get(User, user_id)
    if not user:
        return jsonify({'error': 'Not found'}), 404
    data = request.get_json()
    user.username = data.get('username', user.username)
    user.email = data.get('email', user.email)
    db.session.commit()
    return jsonify(user.to_dict())

@app.route('/api/users/<int:user_id>', methods=['DELETE'])
def delete_user(user_id):
    user = db.session.get(User, user_id)
    if not user:
        return jsonify({'error': 'Not found'}), 404
    db.session.delete(user)
    db.session.commit()
    return '', 204

# Advanced queries
@app.route('/api/users/search')
def search_users():
    query = request.args.get('q', '')
    users = User.query.filter(
        User.username.ilike(f'%{query}%')
    ).order_by(User.created_at.desc()).limit(10).all()
    return jsonify([u.to_dict() for u in users])

# Create tables
with app.app_context():
    db.create_all()

Key Points

•db = SQLAlchemy() created globally, initialized with db.init_app(app)
•Models inherit from db.Model with columns as db.Column instances
•db.session manages transactions: add(), commit(), rollback()
•db.create_all() creates tables from model definitions

Gotchas

•db.create_all() only creates tables that don't exist -- use Flask-Migrate for schema changes
•db.session.commit() is needed after add/delete -- forgetting it means changes are lost
•Querying outside app context raises RuntimeError -- push context first
•SQLALCHEMY_TRACK_MODIFICATIONS should be False to avoid performance overhead

Flask-SQLAlchemy integrates SQLAlchemy with Flask. Define models with db.Model, use db.session for CRUD. Initialize with db.init_app(app) in the factory.

•db.Model for models, db.session for CRUD
•db.init_app(app) for app factory pattern

from flask_sqlalchemy import SQLAlchemy

db = SQLAlchemy()

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(100), nullable=False)

# Query
user = User.query.filter_by(name='Alice').first()
db.session.add(User(name='Bob'))
db.session.commit()

Must db.session.commit() to persist changes

Question 12 / 18

How do you create RESTful APIs with Flask?

REST (Representational State Transfer) uses HTTP methods and URLs to represent resources. Flask is well-suited for building RESTful APIs.

REST conventions:

Method	URL	Action
GET	/api/items	List all items
POST	/api/items	Create new item
GET	/api/items/1	Get item 1
PUT	/api/items/1	Update item 1 (full)
PATCH	/api/items/1	Update item 1 (partial)
DELETE	/api/items/1	Delete item 1

Response codes:

200 OK, 201 Created, 204 No Content
400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
422 Unprocessable Entity, 500 Internal Server Error

Pseudo Code

GET    /api/items     -> list items    (200)
POST   /api/items     -> create item   (201 + Location header)
GET    /api/items/1   -> get item      (200 or 404)
PUT    /api/items/1   -> replace item  (200 or 404)
DELETE /api/items/1   -> delete item   (204 or 404)

Code

from flask import Flask, jsonify, request, url_for
from functools import wraps

app = Flask(__name__)

# In-memory storage for demo
items_db = {
    1: {'id': 1, 'name': 'Widget', 'price': 9.99},
    2: {'id': 2, 'name': 'Gadget', 'price': 19.99},
}
next_id = 3

# Input validation decorator
def require_json(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if not request.is_json:
            return jsonify({'error': 'Content-Type must be application/json'}), 415
        return f(*args, **kwargs)
    return decorated

# LIST
@app.route('/api/items', methods=['GET'])
def list_items():
    page = request.args.get('page', 1, type=int)
    per_page = request.args.get('per_page', 10, type=int)
    items = list(items_db.values())
    start = (page - 1) * per_page
    end = start + per_page
    return jsonify({
        'items': items[start:end],
        'total': len(items),
        'page': page,
        'per_page': per_page,
    })

# CREATE
@app.route('/api/items', methods=['POST'])
@require_json
def create_item():
    global next_id
    data = request.get_json()

    # Validation
    if 'name' not in data:
        return jsonify({'error': 'name is required'}), 400
    if 'price' not in data:
        return jsonify({'error': 'price is required'}), 400

    item = {
        'id': next_id,
        'name': data['name'],
        'price': float(data['price']),
    }
    items_db[next_id] = item
    next_id += 1

    response = jsonify(item)
    response.status_code = 201
    response.headers['Location'] = url_for('get_item', item_id=item['id'])
    return response

# READ
@app.route('/api/items/<int:item_id>', methods=['GET'])
def get_item(item_id):
    item = items_db.get(item_id)
    if not item:
        return jsonify({'error': 'Item not found'}), 404
    return jsonify(item)

# UPDATE (full replacement)
@app.route('/api/items/<int:item_id>', methods=['PUT'])
@require_json
def update_item(item_id):
    if item_id not in items_db:
        return jsonify({'error': 'Item not found'}), 404

    data = request.get_json()
    items_db[item_id] = {
        'id': item_id,
        'name': data['name'],
        'price': float(data['price']),
    }
    return jsonify(items_db[item_id])

# PARTIAL UPDATE
@app.route('/api/items/<int:item_id>', methods=['PATCH'])
@require_json
def patch_item(item_id):
    item = items_db.get(item_id)
    if not item:
        return jsonify({'error': 'Item not found'}), 404

    data = request.get_json()
    if 'name' in data:
        item['name'] = data['name']
    if 'price' in data:
        item['price'] = float(data['price'])
    return jsonify(item)

# DELETE
@app.route('/api/items/<int:item_id>', methods=['DELETE'])
def delete_item(item_id):
    if item_id not in items_db:
        return jsonify({'error': 'Item not found'}), 404
    del items_db[item_id]
    return '', 204

# Error handlers for API
@app.errorhandler(404)
def not_found(error):
    return jsonify({'error': 'Not found'}), 404

@app.errorhandler(405)
def method_not_allowed(error):
    return jsonify({'error': 'Method not allowed'}), 405

Key Points

•Map HTTP methods to CRUD operations: GET=Read, POST=Create, PUT=Update, DELETE=Delete
•Return appropriate status codes: 201 Created, 204 No Content, 404 Not Found
•Include Location header for POST responses pointing to the new resource
•Validate input and return 400/422 for bad requests

Gotchas

•PUT replaces the entire resource; PATCH updates only specified fields
•DELETE should return 204 No Content (empty body), not 200
•POST to a collection creates a new resource; POST to a resource is non-standard
•Always validate input -- never trust client data

Map HTTP methods to CRUD: GET=list/read, POST=create (201), PUT=update, DELETE=remove (204). Use request.get_json() for input, jsonify() for output, proper status codes.

•HTTP methods map to CRUD operations
•201 for create, 204 for delete, 404 for not found

@app.route('/api/items', methods=['GET', 'POST'])
def items():
    if request.method == 'POST':
        data = request.get_json()
        # create item...
        return jsonify(item), 201
    return jsonify({'items': all_items})

@app.route('/api/items/<int:id>', methods=['DELETE'])
def delete(id):
    # delete item...
    return '', 204

PUT replaces entirely; PATCH updates partially

Question 13 / 18

How do Flask-WTF forms work for input validation?

Flask-WTF integrates WTForms with Flask, providing:

CSRF protection automatically
Form validation with built-in and custom validators
File upload handling
Integration with Jinja2 templates

Forms are defined as classes with fields that have validators attached.

Pseudo Code

class LoginForm(FlaskForm):
    username = StringField('Username', validators=[DataRequired()])
    password = PasswordField('Password', validators=[Length(min=8)])
    submit = SubmitField('Login')

# In view:
form = LoginForm()
if form.validate_on_submit():
    # form data is valid
    username = form.username.data

Code

from flask import Flask, render_template_string, redirect, url_for, flash
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, BooleanField, SubmitField, TextAreaField
from wtforms.validators import DataRequired, Email, Length, EqualTo, ValidationError

app = Flask(__name__)
app.config['SECRET_KEY'] = 'dev-secret'

# Form definition
class RegistrationForm(FlaskForm):
    username = StringField('Username', validators=[
        DataRequired(),
        Length(min=3, max=20, message='Username must be 3-20 characters')
    ])
    email = StringField('Email', validators=[
        DataRequired(),
        Email(message='Invalid email address')
    ])
    password = PasswordField('Password', validators=[
        DataRequired(),
        Length(min=8, message='Password must be at least 8 characters')
    ])
    confirm = PasswordField('Confirm Password', validators=[
        DataRequired(),
        EqualTo('password', message='Passwords must match')
    ])
    accept_tos = BooleanField('I accept the Terms of Service', validators=[
        DataRequired(message='You must accept the Terms of Service')
    ])
    submit = SubmitField('Register')

    # Custom validator
    def validate_username(self, field):
        reserved = ['admin', 'root', 'system']
        if field.data.lower() in reserved:
            raise ValidationError('This username is reserved.')

# View using form
@app.route('/register', methods=['GET', 'POST'])
def register():
    form = RegistrationForm()
    if form.validate_on_submit():  # POST + valid
        username = form.username.data
        email = form.email.data
        password = form.password.data
        # Create user...
        flash('Registration successful!', 'success')
        return redirect(url_for('register'))

    # GET or validation failed -- show form with errors
    return render_template_string('''
    <form method="post">
        {{ form.hidden_tag() }}
        {% for field in [form.username, form.email, form.password, form.confirm] %}
            <div>
                {{ field.label }}
                {{ field(size=32) }}
                {% for error in field.errors %}
                    <span style="color:red">{{ error }}</span>
                {% endfor %}
            </div>
        {% endfor %}
        <div>{{ form.accept_tos() }} {{ form.accept_tos.label }}</div>
        {{ form.submit() }}
    </form>
    ''', form=form)

# Simple login form
class LoginForm(FlaskForm):
    username = StringField('Username', validators=[DataRequired()])
    password = PasswordField('Password', validators=[DataRequired()])
    remember = BooleanField('Remember Me')
    submit = SubmitField('Login')

# Contact form with textarea
class ContactForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])
    email = StringField('Email', validators=[DataRequired(), Email()])
    message = TextAreaField('Message', validators=[
        DataRequired(),
        Length(min=10, max=1000)
    ])
    submit = SubmitField('Send')

Key Points

•Forms are classes inheriting FlaskForm with typed fields and validators
•form.validate_on_submit() checks POST + validation in one call
•form.hidden_tag() renders CSRF token in templates
•Custom validators as validate_fieldname(self, field) methods

Gotchas

•CSRF token is required -- form.hidden_tag() must be in the template
•validate_on_submit() returns False for GET requests (by design)
•form.errors is a dict of field -> error list; check after validate_on_submit() fails
•SECRET_KEY is required for CSRF protection -- must be set

Flask-WTF forms are classes with typed fields and validators. form.validate_on_submit() checks POST + validation. form.hidden_tag() renders the CSRF token.

•FlaskForm with validators for input validation + CSRF
•validate_on_submit() = POST + all validators pass

from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired, Length

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired(), Length(max=50)])

@app.route('/form', methods=['GET', 'POST'])
def form_view():
    form = MyForm()
    if form.validate_on_submit():
        name = form.name.data  # validated data
    return render_template('form.html', form=form)

CSRF token (hidden_tag) required in template

Question 14 / 18

How do Flask extensions work and what are the most commonly used ones?

Flask extensions follow a consistent pattern:

Created as module-level instances: ext = Extension()
Initialized with the app: ext.init_app(app) (app factory compatible)
Provide functionality through the instance or decorators

Most commonly used extensions:

Extension	Purpose
Flask-SQLAlchemy	ORM (database)
Flask-Migrate	Database migrations (Alembic)
Flask-Login	User session management
Flask-WTF	Form validation + CSRF
Flask-Mail	Email sending
Flask-CORS	Cross-Origin Resource Sharing
Flask-JWT-Extended	JWT authentication
Flask-Caching	Response/data caching
Flask-Limiter	Rate limiting
Flask-SocketIO	WebSocket support

Pseudo Code

# Extension pattern:
ext = Extension()           # create
ext.init_app(app)           # initialize with app

# Usage:
@ext.decorator              # or
ext.method()                # depends on extension

Code

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate
from flask_cors import CORS

# Create extensions (without app)
db = SQLAlchemy()
migrate = Migrate()

def create_app(config=None):
    app = Flask(__name__)
    app.config.from_mapping(
        SECRET_KEY='dev',
        SQLALCHEMY_DATABASE_URI='sqlite:///app.db',
    )
    if config:
        app.config.update(config)

    # Initialize extensions with app
    db.init_app(app)
    migrate.init_app(app, db)
    CORS(app, resources={r'/api/*': {'origins': '*'}})

    # Register blueprints
    from .routes import main_bp
    app.register_blueprint(main_bp)

    return app

# Flask-Login example
from flask_login import LoginManager, UserMixin, login_required, current_user

login_manager = LoginManager()

class User(UserMixin, db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True)

@login_manager.user_loader
def load_user(user_id):
    return db.session.get(User, int(user_id))

@app.route('/protected')
@login_required
def protected():
    return f'Hello, {current_user.username}!'

# Flask-Caching example
from flask_caching import Cache

cache = Cache(config={'CACHE_TYPE': 'SimpleCache'})

@app.route('/expensive')
@cache.cached(timeout=60)  # cache for 60 seconds
def expensive_view():
    # expensive computation
    return 'result'

# Flask-Limiter example
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(key_func=get_remote_address, default_limits=['100/hour'])

@app.route('/api/data')
@limiter.limit('10/minute')
def rate_limited_api():
    return {'data': 'limited'}

# Flask-Migrate CLI commands:
# flask db init      -> initialize migrations directory
# flask db migrate   -> generate migration from model changes
# flask db upgrade   -> apply migrations to database

Key Points

•Extensions follow init_app pattern for app factory compatibility
•Flask-SQLAlchemy + Flask-Migrate for database management
•Flask-Login for session-based authentication
•Flask-CORS, Flask-Caching, Flask-Limiter for common API needs

Gotchas

•Extensions must be initialized with init_app() when using the app factory pattern
•Extension order can matter -- some depend on others being initialized first
•Flask-Login's @login_required redirects to login page -- set login_manager.login_view
•Flask-Migrate migrations are auto-generated but should always be reviewed before applying

Flask extensions: create globally, initialize with ext.init_app(app). Key extensions: Flask-SQLAlchemy (DB), Flask-Migrate (migrations), Flask-Login (auth), Flask-WTF (forms), Flask-CORS, Flask-Caching.

•init_app pattern for app factory compatibility
•SQLAlchemy + Migrate for database management

from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate

db = SQLAlchemy()
migrate = Migrate()

def create_app():
    app = Flask(__name__)
    db.init_app(app)
    migrate.init_app(app, db)
    return app

Extensions must be initialized in the factory function

Question 15 / 18

How does Flask-Migrate handle database schema changes?

Flask-Migrate wraps Alembic to manage database schema changes (migrations) for Flask-SQLAlchemy. Migrations track incremental changes to the database schema, making it possible to upgrade (apply changes) and downgrade (revert changes).

Workflow:

flask db init -- create migrations directory (once)
Change your models (add columns, tables, etc.)
flask db migrate -m "description" -- auto-generate migration script
Review the generated migration (in migrations/versions/)
flask db upgrade -- apply to database

Key commands:

flask db init -- initialize migrations
flask db migrate -- generate migration from model changes
flask db upgrade -- apply pending migrations
flask db downgrade -- revert last migration
flask db history -- show migration history
flask db current -- show current migration version

Pseudo Code

1. flask db init            -> creates migrations/ directory
2. Add/change model columns
3. flask db migrate -m 'add email column'
4. Review generated migration file
5. flask db upgrade          -> applies changes to DB
6. flask db downgrade        -> reverts if needed

Code

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate

db = SQLAlchemy()
migrate = Migrate()

def create_app():
    app = Flask(__name__)
    app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///app.db'
    db.init_app(app)
    migrate.init_app(app, db)
    return app

# Model (initial version)
class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)

# After running:
#   flask db init
#   flask db migrate -m "initial migration"
#   flask db upgrade

# Later: add a new column
class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    bio = db.Column(db.Text, default='')  # NEW COLUMN
    created_at = db.Column(db.DateTime, server_default=db.func.now())  # NEW

# Then:
#   flask db migrate -m "add bio and created_at to user"
#   flask db upgrade

# Generated migration file looks like:
# (in migrations/versions/xxxx_add_bio_and_created_at.py)
"""
def upgrade():
    op.add_column('user', sa.Column('bio', sa.Text(), nullable=True))
    op.add_column('user', sa.Column('created_at', sa.DateTime(),
                  server_default=sa.text('(CURRENT_TIMESTAMP)')))

def downgrade():
    op.drop_column('user', 'created_at')
    op.drop_column('user', 'bio')
"""

# Custom migration (when auto-detect fails)
"""
# flask db revision -m "custom data migration"

def upgrade():
    # Data migration: populate a new column
    op.execute("UPDATE user SET bio = 'Default bio' WHERE bio IS NULL")

def downgrade():
    pass
"""

Key Points

•flask db migrate auto-generates migrations from model changes
•flask db upgrade applies pending migrations to the database
•Always review generated migrations before applying
•flask db downgrade reverts the last migration

Gotchas

•Auto-generated migrations may miss some changes (table renames, data migrations)
•SQLite has limited ALTER TABLE support -- some migrations require workarounds
•Always review generated migrations -- auto-detect can get column order or constraints wrong
•Running migrate without changes generates an empty migration file

Flask-Migrate wraps Alembic for database migrations. Workflow: flask db init (once), change models, flask db migrate -m 'description', review, flask db upgrade.

•migrate generates, upgrade applies, downgrade reverts
•Always review auto-generated migration files

# Terminal commands:
# flask db init                    # once
# flask db migrate -m 'add users'  # generate
# flask db upgrade                 # apply
# flask db downgrade               # revert

from flask_migrate import Migrate
migrate = Migrate()
migrate.init_app(app, db)

SQLite has limited ALTER TABLE support

Question 16 / 18

How does Flask's CLI system work?

Flask's CLI is built on Click and provides a flask command for running the development server, database operations, and custom commands.

Key features:

flask run -- start the development server
flask shell -- interactive shell with app context
Custom commands with @app.cli.command() or Click groups
Blueprint commands with bp.cli.command()
Environment variables: FLASK_APP, FLASK_ENV, FLASK_DEBUG

Pseudo Code

@app.cli.command()
@click.argument('name')
def greet(name):
    """Greet someone."""
    click.echo(f'Hello, {name}!')

# Usage: flask greet Alice

Code

from flask import Flask
import click

app = Flask(__name__)

# Basic CLI command
@app.cli.command()
def init_db():
    """Initialize the database."""
    # db.create_all()
    click.echo('Database initialized.')

# Command with arguments and options
@app.cli.command()
@click.argument('username')
@click.option('--role', default='user', help='User role')
def create_user(username, role):
    """Create a new user."""
    click.echo(f'Created user: {username} (role: {role})')

# Usage: flask create-user alice --role admin

# Command group
@app.cli.group()
def seed():
    """Seed the database with sample data."""
    pass

@seed.command()
def users():
    """Seed sample users."""
    click.echo('Seeding users...')

@seed.command()
def products():
    """Seed sample products."""
    click.echo('Seeding products...')

# Usage: flask seed users
#        flask seed products

# Command with confirmation
@app.cli.command()
@click.confirmation_option(prompt='Are you sure you want to drop all tables?')
def drop_db():
    """Drop all database tables."""
    # db.drop_all()
    click.echo('All tables dropped.')

# Blueprint commands
from flask import Blueprint

admin_bp = Blueprint('admin', __name__)

@admin_bp.cli.command()
def report():
    """Generate admin report."""
    click.echo('Generating report...')

# Usage: flask admin report

app.register_blueprint(admin_bp)

# .flaskenv file (load with python-dotenv)
# FLASK_APP=myapp:create_app
# FLASK_DEBUG=1
# FLASK_RUN_PORT=5000

Key Points

•Flask CLI is built on Click -- use Click decorators for arguments/options
•@app.cli.command() registers commands available via 'flask' command
•CLI commands automatically have application context
•Use .flaskenv for environment variables (requires python-dotenv)

Gotchas

•FLASK_APP must be set for the flask command to find your app
•CLI commands run inside application context but NOT request context
•Command names use hyphens in CLI (create-user) but underscores in Python (create_user)
•Blueprint CLI commands are prefixed with blueprint name (flask bp-name command)

Flask CLI uses Click. Register commands with @app.cli.command(). Use Click decorators for arguments/options. Commands auto-have app context. Set FLASK_APP env var.

•@app.cli.command() registers CLI commands
•Commands auto-have application context

import click

@app.cli.command()
@click.argument('name')
def greet(name):
    """Greet someone."""
    click.echo(f'Hello, {name}!')

# flask greet Alice -> Hello, Alice!

FLASK_APP env var must be set

Question 17 / 18

How do you structure a larger Flask application?

Small Flask apps can be a single file, but larger apps need organized structure. Two common patterns:

Package-based structure (recommended)

myapp/
  __init__.py          # app factory (create_app)
  config.py            # configuration classes
  extensions.py        # db, migrate, login_manager
  models/
    __init__.py
    user.py
    post.py
  routes/
    __init__.py
    auth.py            # auth blueprint
    api.py             # api blueprint
  services/
    __init__.py
    user_service.py    # business logic
  templates/
  static/
  tests/

Key principles:

App factory in __init__.py
Extensions in a separate file (avoid circular imports)
Blueprints for route organization
Services for business logic (separate from routes)
Models for data layer
Config classes for different environments

Pseudo Code

myapp/__init__.py -> create_app()
myapp/extensions.py -> db, migrate, login_manager
myapp/models/ -> User, Post, etc.
myapp/routes/ -> auth_bp, api_bp, main_bp
myapp/services/ -> business logic
myapp/config.py -> Dev/Test/Prod configs

Code

# myapp/config.py
class Config:
    SECRET_KEY = 'change-in-production'
    SQLALCHEMY_TRACK_MODIFICATIONS = False

class DevelopmentConfig(Config):
    DEBUG = True
    SQLALCHEMY_DATABASE_URI = 'sqlite:///dev.db'

class TestingConfig(Config):
    TESTING = True
    SQLALCHEMY_DATABASE_URI = 'sqlite:///:memory:'

class ProductionConfig(Config):
    SQLALCHEMY_DATABASE_URI = 'postgresql://user:pass@host/db'

config_map = {
    'development': DevelopmentConfig,
    'testing': TestingConfig,
    'production': ProductionConfig,
}

# myapp/extensions.py
from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate
from flask_login import LoginManager

db = SQLAlchemy()
migrate = Migrate()
login_manager = LoginManager()

# myapp/models/user.py
from myapp.extensions import db

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)

    def to_dict(self):
        return {'id': self.id, 'username': self.username, 'email': self.email}

# myapp/services/user_service.py
from myapp.extensions import db
from myapp.models.user import User

class UserService:
    @staticmethod
    def create_user(username, email):
        user = User(username=username, email=email)
        db.session.add(user)
        db.session.commit()
        return user

    @staticmethod
    def get_user(user_id):
        return db.session.get(User, user_id)

# myapp/routes/api.py
from flask import Blueprint, jsonify, request
from myapp.services.user_service import UserService

api_bp = Blueprint('api', __name__, url_prefix='/api')

@api_bp.route('/users', methods=['GET'])
def list_users():
    users = UserService.get_all()
    return jsonify([u.to_dict() for u in users])

@api_bp.route('/users', methods=['POST'])
def create_user():
    data = request.get_json()
    user = UserService.create_user(data['username'], data['email'])
    return jsonify(user.to_dict()), 201

# myapp/__init__.py
from flask import Flask
from myapp.config import config_map
from myapp.extensions import db, migrate, login_manager

def create_app(config_name='development'):
    app = Flask(__name__)
    app.config.from_object(config_map[config_name])

    # Initialize extensions
    db.init_app(app)
    migrate.init_app(app, db)
    login_manager.init_app(app)

    # Register blueprints
    from myapp.routes.api import api_bp
    from myapp.routes.auth import auth_bp
    app.register_blueprint(api_bp)
    app.register_blueprint(auth_bp)

    return app

Key Points

•App factory in __init__.py, extensions in separate file
•Blueprints for route organization, services for business logic
•Config classes for different environments (dev/test/prod)
•Models separate from routes -- clean separation of concerns

Gotchas

•Circular imports are the #1 issue -- solve with app factory + late imports
•Import blueprints inside create_app(), not at module level
•Extensions file should NOT import from models (circular dependency)
•Test fixtures should use the TestingConfig with in-memory database

Structure: __init__.py (app factory), extensions.py (db, etc.), models/, routes/ (blueprints), services/ (business logic), config.py (environment configs). Import blueprints inside create_app() to avoid circular imports.

•App factory + extensions file + blueprints
•Import blueprints inside create_app

# myapp/__init__.py
def create_app(config='development'):
    app = Flask(__name__)
    app.config.from_object(config_map[config])
    db.init_app(app)
    from .routes.api import api_bp
    app.register_blueprint(api_bp)
    return app

Circular imports are the #1 issue in Flask projects

Question 18 / 18

How does Flask handle static files and how do you configure them for production?

Flask serves static files from the static/ directory in your application package. In templates, use url_for('static', filename='...') to generate URLs.

Development:

Flask's built-in server serves static files directly.

Production:

Never use Flask to serve static files in production. Use:

Nginx/Apache: Configure to serve /static/ directly
CDN: Upload static files to CloudFront, Cloudflare, etc.
WhiteNoise: WSGI middleware for simple deployments

Cache busting:

Append a version hash to filenames so browsers fetch updated files: style.css?v=abc123.

Pseudo Code

Development:
  Flask serves /static/style.css from app/static/style.css

Production:
  Nginx serves /static/ directly (faster, no Python involved)
  Flask handles only dynamic routes

Code

from flask import Flask, url_for, send_from_directory
import os

app = Flask(__name__,
            static_folder='static',      # default
            static_url_path='/static')    # default

# In Jinja2 templates:
# <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
# <script src="{{ url_for('static', filename='js/app.js') }}"></script>
# <img src="{{ url_for('static', filename='images/logo.png') }}">

# Custom static file route (for uploads, etc.)
@app.route('/uploads/<path:filename>')
def serve_upload(filename):
    uploads_dir = os.path.join(app.root_path, 'uploads')
    return send_from_directory(uploads_dir, filename)

# Blueprint with its own static folder
from flask import Blueprint

admin_bp = Blueprint('admin', __name__,
                     static_folder='admin_static',
                     static_url_path='/admin/static')

# In template: {{ url_for('admin.static', filename='admin.css') }}

# Cache busting with config
app.config['SEND_FILE_MAX_AGE_DEFAULT'] = 0  # dev: no cache
# production: set to 31536000 (1 year), use versioned filenames

# Nginx configuration for production:
nginx_config = """
server {
    listen 80;
    server_name example.com;

    # Serve static files directly (bypass Flask)
    location /static/ {
        alias /path/to/myapp/static/;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Proxy dynamic requests to Flask (Gunicorn)
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
"""

# WhiteNoise for simple deployments (no Nginx)
# pip install whitenoise
# from whitenoise import WhiteNoise
# app.wsgi_app = WhiteNoise(app.wsgi_app, root='static/', prefix='static/')

# File structure:
# myapp/
#   static/
#     css/
#       style.css
#     js/
#       app.js
#     images/
#       logo.png
#   templates/
#     base.html

Key Points

•Flask serves from static/ directory; use url_for('static', filename=...) in templates
•In production, use Nginx/CDN to serve static files, not Flask
•send_from_directory for safely serving files from custom directories
•Cache busting ensures browsers load updated files

Gotchas

•Never use Flask's built-in server to serve static files in production (slow, insecure)
•send_from_directory prevents directory traversal attacks (never use open() for user paths)
•Blueprint static files need their own static_folder parameter
•SEND_FILE_MAX_AGE_DEFAULT=0 disables caching (development only)

Flask serves from static/ directory. Use url_for('static', filename='...') in templates. In production, use Nginx/CDN -- never Flask's built-in server for static files.

•url_for('static', filename=...) for template URLs
•Nginx/CDN for production static file serving

from flask import url_for, send_from_directory

# In template:
# <link href="{{ url_for('static', filename='css/style.css') }}">

# Custom file serving (safe):
@app.route('/uploads/<path:filename>')
def upload(filename):
    return send_from_directory('uploads', filename)

Never serve static files with Flask in production

Built by onllm.dev

Home GitHub Support awesomePrep

What is the Flask application factory pattern and why should you use it?

Why use it:

How does Flask routing work, including URL parameters and HTTP methods?

URL parameters:

HTTP methods:

URL building:

What are Flask blueprints and how do they help organize larger applications?

Benefits:

Common patterns:

How do Jinja2 template filters, macros, and inheritance work in Flask?

Template Inheritance

Filters

Macros

How do Flask request and response objects work?

The request object

Key request attributes:

The response object

How do before_request and after_request hooks work in Flask?

Hooks (in execution order):

Additional hooks:

How do sessions and cookies work in Flask?

Cookies

Sessions

Session storage:

Security considerations:

How do you handle errors and create custom error pages in Flask?

Error handling approaches:

What is the difference between Flask's application context and request context?

Application Context

Request Context

When you need to manually push contexts:

How do you test Flask applications?

Key testing tools:

With pytest:

How does Flask-SQLAlchemy integrate with Flask?

Key features:

How do you create RESTful APIs with Flask?

REST conventions:

Response codes:

How do Flask-WTF forms work for input validation?

How do Flask extensions work and what are the most commonly used ones?

Most commonly used extensions:

How does Flask-Migrate handle database schema changes?

Workflow:

Key commands:

How does Flask's CLI system work?

Key features:

How do you structure a larger Flask application?

Package-based structure (recommended)

Key principles:

How does Flask handle static files and how do you configure them for production?

Development:

Production:

Cache busting:

Flask (routing, blueprints, Jinja2, middleware)

The `request` object

Key `request` attributes:

The `response` object