Flask
Flask is Python's classic microframework: routing, request handling, and templating in a tiny core, with everything else — database, auth, validation — left to extensions you choose. Where Django hands you a complete kitchen, Flask hands you a stove and lets you build the rest.
That minimalism made Flask the second-most-used Python web framework for over a decade. It remains the go-to for small services, internal tools, webhooks, and teams who want to see and control every piece of their stack — and it's often the first web framework Python developers learn, because a working app is five lines long.
TL;DR
- Flask's core is routing + request/response + Jinja templates; everything else is an extension or your own code.
- Decorators map URLs to functions:
@app.route("/users/<int:id>"). - Blueprints split a growing app into modules; the application factory pattern (
create_app()) keeps configuration testable. - The ecosystem standard kit: Flask-SQLAlchemy (ORM), Flask-Migrate (migrations), Flask-Login (sessions), Flask-WTF (forms).
- Flask is WSGI/sync — fine for typical CRUD; for async-heavy or type-driven JSON APIs, FastAPI (or Flask's spiritual async successor, Quart) fits better.
- Deploy behind Gunicorn + Nginx — never the built-in dev server.
Quick Example
A complete JSON API in one file:
Core Concepts
Routing
URL rules live in decorators, with typed converters:
methods=["GET", "POST"] controls verbs; request.args holds query params, request.get_json() the body, request.form form fields.
Blueprints and the Application Factory
One-file apps rot fast. The scalable shape is blueprints (route modules) assembled by a factory:
The factory pattern matters for testing: each test can build a fresh app with test configuration instead of importing a global singleton.
Contexts and g
Flask's request, session, and g objects are context-locals — they look global but are scoped to the current request. Use g to stash per-request state (a DB connection, the current user) and teardown hooks to clean it up:
The Extension Kit
This is the trade: you assemble the stack, which means you understand the stack — and also that you own its upgrades and integration bugs.
Testing
Flask's test client makes HTTP tests plain functions:
Pair with pytest fixtures for database setup/teardown.
Flask vs Django vs FastAPI
Honest guidance for new projects: choose Django when you need its batteries, FastAPI when the product is a typed JSON API. Choose Flask when you want a small, explicit, sync service — or when the team already knows it well, which counts for a lot.
Common Mistakes
Running the Dev Server in Production
app.run(debug=True) is single-threaded and, with debug on, exposes an interactive code-execution console on errors. Production means Gunicorn:
One Giant app.py
Routes, models, and config in one file works until it very much doesn't. Adopt blueprints + the application factory before the file passes a few hundred lines.
Hardcoding SECRET_KEY
Flask signs session cookies with SECRET_KEY. A guessable or committed key lets attackers forge sessions. Load it from the environment (secrets management) and keep it out of git.
Doing Slow Work in Request Handlers
WSGI workers are a fixed pool — a handler that calls a slow third-party API ties up a worker for the duration. Push slow work to background jobs.
FAQ
Is Flask still relevant with FastAPI around?
Yes — Flask remains massively deployed, actively maintained (3.x), and often the pragmatic choice for sync services and teams with existing Flask code. FastAPI has won the "new typed JSON API" niche; Flask keeps the "small explicit web app" one.
Can Flask do async?
Flask 2+ accepts async def views, but it still runs on WSGI — each async view spins its own event loop, so you don't get FastAPI-style concurrency. For real async, use Quart (Flask's API on ASGI) or FastAPI.
Flask or Django for a beginner?
Flask teaches you what a web framework does — requests, routing, sessions — because you wire it yourself. Django teaches you conventions faster. For learning fundamentals, Flask; for shipping a real product sooner, Django.
How do I structure a large Flask app?
Blueprints per domain (users, orders), an application factory, a services/ layer for business logic, and config classes per environment. At the point you're rebuilding an admin panel and auth system from extensions, reconsider Django.
What is Jinja?
Flask's bundled template engine ({{ variable }}, {% for %}) — server-rendered HTML with auto-escaping (your XSS baseline). It's also used standalone by Ansible and many other tools.
Related Topics
- Python — The language underneath
- Django — The batteries-included alternative
- FastAPI — The typed async alternative
- REST API Design — Designing the endpoints
- Database Migrations — Alembic via Flask-Migrate
- pytest — Testing Flask apps
- Nginx — The production front door