Flask, end to end

mkdir myapp && cd myapp

# macOS / Linux
python3 -m venv .venv
source .venv/bin/activate

# Windows (PowerShell)
py -m venv .venv
.venv\Scripts\activate

pip install Flask

from flask import Flask

app = Flask(__name__)


@app.route("/")
def home():
    return "Hello, World!"


@app.route("/about")
def about():
    return "<h1>About this site</h1>"

flask --app app run --debug

pip freeze > requirements.txt   # save
pip install -r requirements.txt # restore, on another machine

@app.route("/user/<username>")
def profile(username):
    return f"Profile of {username}"


@app.route("/post/<int:post_id>")
def show_post(post_id):
    return f"Post number {post_id + 1}"   # already an int


@app.route("/files/<path:filepath>")
def serve(filepath):
    return f"You asked for {filepath}"       # slashes allowed

from flask import url_for

url_for("home")                       # /
url_for("show_post", post_id=7)        # /post/7
url_for("profile", username="ada", tab="bio")
                                      # /user/ada?tab=bio
url_for("static", filename="style.css")
                                      # /static/style.css

app.add_url_rule("/health", "health", lambda: "ok")
# path, endpoint name, view function

from flask import request

@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        user = request.form["username"]        # 400 if missing
        pw   = request.form.get("password", "") # default if missing
        return f"Welcome {user}"
    return "<form method='post'>…</form>"

page = request.args.get("page", 1, type=int)   # 1 if absent or junk
tags = request.args.getlist("tag")            # ?tag=a&tag=b -> ["a","b"]

return "plain text or html"                 # 200
return "Not found", 404                    # body + status
return "Created", 201, {"Location": "/post/7"}
return {"id": 7, "title": "Hello"}         # dict -> JSON
return [1, 2, 3]                            # list -> JSON

from flask import make_response, jsonify

@app.get("/api/time")
def now():
    resp = make_response(jsonify(time="12:00"))
    resp.headers["Cache-Control"] = "no-store"
    resp.set_cookie("seen", "1", max_age=3600, httponly=True, samesite="Lax")
    return resp

from flask import redirect, url_for, abort

@app.post("/posts")
def create():
    # … save …
    return redirect(url_for("show_post", post_id=7))


@app.get("/admin")
def admin():
    if not user_is_admin():
        abort(403)              # raises, stops here
    return "Dashboard"

from flask import send_file, send_from_directory

return send_file("report.pdf", as_attachment=True)
return send_from_directory("uploads", filename)  # safe path join

from flask import render_template

@app.get("/posts")
def posts():
    items = [{"id": 1, "title": "First"}, {"id": 2, "title": "Second"}]
    return render_template("posts.html", posts=items, user="Ada")

<h1>Hello, {{ user }}</h1>

{% if posts %}
  <ul>
  {% for post in posts %}
    <li>
      <a href="{{ url_for('show_post', post_id=post.id) }}">{{ post.title }}</a>
      {% if loop.first %} <em>newest</em>{% endif %}
    </li>
  {% endfor %}
  </ul>
{% else %}
  <p>Nothing published yet.</p>
{% endif %}

{{ name|upper }}
{{ price|round(2) }}
{{ body|truncate(140) }}
{{ items|length }}
{{ missing|default("n/a") }}
{{ text|replace("a", "b")|title }}
{{ html_string|safe }}          {# render as HTML, do not escape #}

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>{% block title %}My site{% endblock %}</title>
  <link rel="stylesheet" href="{{ url_for('static', filename='style.css') }}">
</head>
<body>
  <nav><a href="{{ url_for('home') }}">Home</a></nav>
  <main>{% block content %}{% endblock %}</main>
</body>
</html>

{% extends "base.html" %}

{% block title %}Posts · {{ super() }}{% endblock %}

{% block content %}
  <h1>Posts</h1>
  …
{% endblock %}

{% macro field(name, label, type="text", value="") %}
  <label>{{ label }}
    <input name="{{ name }}" type="{{ type }}" value="{{ value }}">
  </label>
{% endmacro %}

{# use it elsewhere #}
{% from "macros.html" import field %}
{{ field("email", "Email address", type="email") }}

@app.context_processor
def inject_globals():
    return {"site_name": "My site", "year": 2026}
# {{ site_name }} now works in every template

<link rel="stylesheet" href="{{ url_for('static', filename='style.css') }}">
<script src="{{ url_for('static', filename='app.js') }}" defer></script>
<img src="{{ url_for('static', filename='img/logo.svg') }}" alt="Logo">

@app.route("/signup", methods=["GET", "POST"])
def signup():
    errors = {}
    if request.method == "POST":
        email = request.form.get("email", "").strip()
        pw    = request.form.get("password", "")

        if "@" not in email:
            errors["email"] = "Enter a valid email address."
        if len(pw) < 8:
            errors["password"] = "Use at least 8 characters."

        if not errors:
            create_user(email, pw)
            return redirect(url_for("home"))

    return render_template("signup.html", errors=errors)

pip install Flask-WTF

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Email, Length, EqualTo


class SignupForm(FlaskForm):
    email = StringField("Email", validators=[DataRequired(), Email()])
    password = PasswordField("Password", validators=[DataRequired(), Length(min=8)])
    confirm = PasswordField("Repeat password", validators=[EqualTo("password")])
    submit = SubmitField("Create account")

@app.route("/signup", methods=["GET", "POST"])
def signup():
    form = SignupForm()
    if form.validate_on_submit():        # POST + all validators pass
        create_user(form.email.data, form.password.data)
        return redirect(url_for("home"))
    return render_template("signup.html", form=form)

<form method="post">
  {{ form.hidden_tag() }}              {# CSRF token #}
  {{ form.email.label }} {{ form.email() }}
  {% for e in form.email.errors %}<p class="error">{{ e }}</p>{% endfor %}

  {{ form.password.label }} {{ form.password() }}
  {% for e in form.password.errors %}<p class="error">{{ e }}</p>{% endfor %}

  {{ form.submit() }}
</form>

from flask import session

app.secret_key = os.environ["SECRET_KEY"]   # required

@app.post("/login")
def login():
    session["user_id"] = 7
    session.permanent = True                # survives browser restart
    return redirect(url_for("home"))

@app.post("/logout")
def logout():
    session.clear()
    return redirect(url_for("home"))

from flask import flash

flash("Your changes were saved.", "success")
flash("That email is already registered.", "error")

{% with messages = get_flashed_messages(with_categories=true) %}
  {% for category, message in messages %}
    <div class="alert alert-{{ category }}">{{ message }}</div>
  {% endfor %}
{% endwith %}

theme = request.cookies.get("theme", "light")

resp = make_response(render_template("page.html"))
resp.set_cookie("theme", "dark", max_age=60*60*24*365,
                httponly=True, secure=True, samesite="Lax")
return resp

@app.errorhandler(404)
def not_found(e):
    return render_template("404.html"), 404


@app.errorhandler(500)
def server_error(e):
    return render_template("500.html"), 500


@app.errorhandler(ValueError)          # by exception class
def bad_value(e):
    return {"error": str(e)}, 400

from flask import abort

post = Post.query.get(post_id)
if post is None:
    abort(404)

# or, with Flask-SQLAlchemy:
post = db.get_or_404(Post, post_id)

from werkzeug.exceptions import HTTPException

@app.errorhandler(HTTPException)
def handle_http_error(e):
    if request.path.startswith("/api/"):
        return {"error": e.name, "detail": e.description}, e.code
    return render_template("error.html", error=e), e.code

import os


class Config:
    SECRET_KEY = os.environ.get("SECRET_KEY", "dev-only-not-for-production")
    SQLALCHEMY_DATABASE_URI = os.environ.get("DATABASE_URL", "sqlite:///app.db")
    MAX_CONTENT_LENGTH = 16 * 1024 * 1024     # 16 MB uploads


class DevConfig(Config):
    DEBUG = True


class ProdConfig(Config):
    SESSION_COOKIE_SECURE = True
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = "Lax"

app.config.from_object(DevConfig)
app.config.from_prefixed_env()        # reads FLASK_* environment vars
app.config["SECRET_KEY"]

pip install python-dotenv

# .env  (never commit this file)
SECRET_KEY=6f1c…
DATABASE_URL=postgresql://user:pass@localhost/mydb

from flask import Flask
from .extensions import db, migrate, login_manager


def create_app(config_object="config.DevConfig"):
    app = Flask(__name__)
    app.config.from_object(config_object)

    db.init_app(app)
    migrate.init_app(app, db)
    login_manager.init_app(app)

    from .blog import bp as blog_bp
    from .auth import bp as auth_bp
    app.register_blueprint(blog_bp)
    app.register_blueprint(auth_bp, url_prefix="/auth")

    return app

from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate
from flask_login import LoginManager

db = SQLAlchemy()
migrate = Migrate()
login_manager = LoginManager()
login_manager.login_view = "auth.login"

from flask import Blueprint, render_template

bp = Blueprint("blog", __name__, template_folder="templates")


@bp.get("/")
def index():
    return render_template("blog/index.html")


@bp.get("/post/<int:post_id>")
def show(post_id):
    return render_template("blog/show.html", post_id=post_id)

@bp.before_request
def require_login():
    if "user_id" not in session:
        return redirect(url_for("auth.login"))


@bp.errorhandler(404)
def blog_404(e):
    return render_template("blog/404.html"), 404

pip install Flask-SQLAlchemy

from datetime import datetime, timezone
from .extensions import db


class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(120), unique=True, nullable=False, index=True)
    password_hash = db.Column(db.String(256), nullable=False)
    posts = db.relationship("Post", back_populates="author", cascade="all, delete-orphan")

    def __repr__(self):
        return f"<User {self.email}>"


class Post(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(200), nullable=False)
    body = db.Column(db.Text, default="")
    created = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
    user_id = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=False)
    author = db.relationship("User", back_populates="posts")

with app.app_context():
    db.create_all()

from sqlalchemy import select

# modern SQLAlchemy 2.x style
posts = db.session.scalars(
    select(Post).where(Post.title.ilike("%flask%"))
                .order_by(Post.created.desc())
                .limit(10)
).all()

one = db.session.get(Post, 7)          # by primary key, or None
one = db.get_or_404(Post, 7)           # or raise 404

# paginate (Flask-SQLAlchemy helper)
page = db.paginate(select(Post).order_by(Post.created.desc()), per_page=20)
page.items, page.has_next, page.next_num

post = Post(title="Hello", body="First post", author=current_user)
db.session.add(post)
db.session.commit()

post.title = "Hello, edited"
db.session.commit()

db.session.delete(post)
db.session.commit()

pip install Flask-Migrate

flask db init                          # once, creates migrations/
flask db migrate -m "add posts table"  # generate a script
flask db upgrade                       # apply it

flask db downgrade                     # undo the last one
flask db current                       # which version is applied

import click

@app.cli.command("seed")
def seed():
    """Insert sample data."""
    db.session.add(User(email="ada@example.com", password_hash="…"))
    db.session.commit()
    click.echo("Seeded.")

# flask seed

from werkzeug.security import generate_password_hash, check_password_hash


class User(db.Model, UserMixin):
    # … columns …

    def set_password(self, raw):
        self.password_hash = generate_password_hash(raw)

    def check_password(self, raw):
        return check_password_hash(self.password_hash, raw)

pip install Flask-Login

from flask_login import login_user, logout_user, login_required, current_user
from ..extensions import db, login_manager
from ..models import User


@login_manager.user_loader
def load_user(user_id):
    return db.session.get(User, int(user_id))


@bp.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        user = db.session.scalar(select(User).where(User.email == form.email.data))
        if user and user.check_password(form.password.data):
            login_user(user, remember=form.remember.data)
            return redirect(url_for("blog.index"))
        flash("Email or password is incorrect.", "error")
    return render_template("auth/login.html", form=form)


@bp.post("/logout")
@login_required
def logout():
    logout_user()
    return redirect(url_for("blog.index"))

@bp.get("/dashboard")
@login_required
def dashboard():
    return render_template("dashboard.html")

{% if current_user.is_authenticated %}
  <span>{{ current_user.email }}</span>
  <form method="post" action="{{ url_for('auth.logout') }}"><button>Log out</button></form>
{% else %}
  <a href="{{ url_for('auth.login') }}">Log in</a>
{% endif %}

from functools import wraps


def admin_required(view):
    @wraps(view)
    @login_required
    def wrapped(*args, **kwargs):
        if not current_user.is_admin:
            abort(403)
        return view(*args, **kwargs)
    return wrapped

from flask import Blueprint, request

api = Blueprint("api", __name__, url_prefix="/api")


def serialize(post):
    return {
        "id": post.id,
        "title": post.title,
        "body": post.body,
        "created": post.created.isoformat(),
    }


@api.get("/posts")
def list_posts():
    posts = db.session.scalars(select(Post).order_by(Post.created.desc())).all()
    return {"posts": [serialize(p) for p in posts]}


@api.get("/posts/<int:post_id>")
def get_post(post_id):
    return serialize(db.get_or_404(Post, post_id))


@api.post("/posts")
def create_post():
    data = request.get_json(silent=True) or {}
    title = (data.get("title") or "").strip()
    if not title:
        return {"error": "title is required"}, 400

    post = Post(title=title, body=data.get("body", ""), user_id=1)
    db.session.add(post)
    db.session.commit()
    return serialize(post), 201, {"Location": url_for("api.get_post", post_id=post.id)}


@api.delete("/posts/<int:post_id>")
def delete_post(post_id):
    post = db.get_or_404(Post, post_id)
    db.session.delete(post)
    db.session.commit()
    return "", 204

pip install Flask-Cors

from flask_cors import CORS
CORS(app, resources={r"/api/*": {"origins": ["https://myfrontend.com"]}})

import os, uuid
from werkzeug.utils import secure_filename

ALLOWED = {"png", "jpg", "jpeg", "gif", "pdf"}
app.config["UPLOAD_FOLDER"] = "uploads"
app.config["MAX_CONTENT_LENGTH"] = 16 * 1024 * 1024


@app.post("/upload")
def upload():
    file = request.files.get("file")
    if not file or file.filename == "":
        flash("Choose a file first.", "error")
        return redirect(request.url)

    ext = file.filename.rsplit(".", 1)[-1].lower()
    if ext not in ALLOWED:
        flash("That file type is not accepted.", "error")
        return redirect(request.url)

    name = f"{uuid.uuid4().hex}.{ext}"          # avoid collisions
    file.save(os.path.join(app.config["UPLOAD_FOLDER"], secure_filename(name)))
    flash("Uploaded.", "success")
    return redirect(url_for("home"))

@app.get("/uploads/<name>")
def uploaded_file(name):
    return send_from_directory(app.config["UPLOAD_FOLDER"], name)

import time
from flask import g


@app.before_request
def start_timer():
    g.start = time.perf_counter()


@app.after_request                     # skipped if an exception escaped
def add_headers(response):
    response.headers["X-Runtime"] = f"{time.perf_counter() - g.start:.3f}s"
    response.headers["X-Content-Type-Options"] = "nosniff"
    return response                    # must return it


@app.teardown_request                  # always runs
def cleanup(exception):
    pass

app = create_app()

with app.app_context():
    db.create_all()
    print(current_app.config["SECRET_KEY"])

@app.shell_context_processor
def shell_objects():
    return {"db": db, "User": User, "Post": Post}

# flask shell

app.logger.debug("query took %s ms", ms)
app.logger.info("user %s logged in", user.id)
app.logger.warning("payment retry %s", attempt)
app.logger.error("checkout failed", exc_info=True)   # includes traceback

import logging
from logging.handlers import RotatingFileHandler

if not app.debug:
    handler = RotatingFileHandler("logs/app.log", maxBytes=1_000_000, backupCount=5)
    handler.setFormatter(logging.Formatter(
        "%(asctime)s %(levelname)s %(message)s [in %(pathname)s:%(lineno)d]"))
    handler.setLevel(logging.INFO)
    app.logger.addHandler(handler)
    app.logger.setLevel(logging.INFO)

pip install pytest

import pytest
from app import create_app
from app.extensions import db as _db


@pytest.fixture
def app():
    app = create_app("config.Config")
    app.config.update(TESTING=True,
                      SQLALCHEMY_DATABASE_URI="sqlite:///:memory:",
                      WTF_CSRF_ENABLED=False)
    with app.app_context():
        _db.create_all()
        yield app
        _db.session.remove()
        _db.drop_all()


@pytest.fixture
def client(app):
    return app.test_client()


@pytest.fixture
def runner(app):
    return app.test_cli_runner()

def test_home_page(client):
    r = client.get("/")
    assert r.status_code == 200
    assert b"Posts" in r.data


def test_create_post_api(client):
    r = client.post("/api/posts", json={"title": "Hi"})
    assert r.status_code == 201
    assert r.get_json()["title"] == "Hi"


def test_missing_title_is_rejected(client):
    assert client.post("/api/posts", json={}).status_code == 400


def test_login_redirects(client):
    r = client.post("/auth/login",
                    data={"email": "ada@example.com", "password": "secret123"},
                    follow_redirects=True)
    assert b"ada@example.com" in r.data

from app import create_app

app = create_app("config.ProdConfig")

pip install gunicorn

gunicorn --workers 4 --bind 0.0.0.0:8000 wsgi:app

from werkzeug.middleware.proxy_fix import ProxyFix

app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)

FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .
EXPOSE 8000
CMD ["gunicorn", "--workers", "4", "--bind", "0.0.0.0:8000", "wsgi:app"]