<li><p>First we imported the <aclass="reference internal"href="api.html#flask.Flask"title="flask.Flask"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Flask</span></code></a> class. An instance of
this class will be our WSGI application.</p></li>
<li><p>Next we create an instance of this class. The first argument is the
name of the application’s module or package. <codeclass="docutils literal notranslate"><spanclass="pre">__name__</span></code> is a
convenient shortcut for this that is appropriate for most cases.
This is needed so that Flask knows where to look for resources such
as templates and static files.</p></li>
<li><p>We then use the <aclass="reference internal"href="api.html#flask.Flask.route"title="flask.Flask.route"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">route()</span></code></a> decorator to tell Flask
what URL should trigger our function.</p></li>
<li><p>The function returns the message we want to display in the user’s
browser. The default content type is HTML, so HTML in the string
will be rendered by the browser.</p></li>
</ol>
<p>Save it as <codeclass="file docutils literal notranslate"><spanclass="pre">hello.py</span></code> or something similar. Make sure to not call
your application <codeclass="file docutils literal notranslate"><spanclass="pre">flask.py</span></code> because this would conflict with Flask
itself.</p>
<p>To run the application, use the <codeclass="docutils literal notranslate"><spanclass="pre">flask</span></code> command or
<codeclass="docutils literal notranslate"><spanclass="pre">python</span><spanclass="pre">-m</span><spanclass="pre">flask</span></code>. You need to tell the Flask where your application
is with the <codeclass="docutils literal notranslate"><spanclass="pre">--app</span></code> option.</p>
<divclass="highlight-text notranslate"><divclass="highlight"><pre><span></span>$ flask --app hello run
* Serving Flask app 'hello'
* Running on http://127.0.0.1:5000 (Press CTRL+C to quit)
<p>As a shortcut, if the file is named <codeclass="docutils literal notranslate"><spanclass="pre">app.py</span></code> or <codeclass="docutils literal notranslate"><spanclass="pre">wsgi.py</span></code>, you
don’t have to use <codeclass="docutils literal notranslate"><spanclass="pre">--app</span></code>. See <aclass="reference internal"href="cli.html"><spanclass="doc">Command Line Interface</span></a> for more details.</p>
</div>
<p>This launches a very simple builtin server, which is good enough for
testing but probably not what you want to use in production. For
deployment options see <aclass="reference internal"href="deploying/index.html"><spanclass="doc">Deploying to Production</span></a>.</p>
<p>Now head over to <aclass="reference external"href="http://127.0.0.1:5000/">http://127.0.0.1:5000/</a>, and you should see your hello
world greeting.</p>
<p>If another program is already using port 5000, you’ll see
<codeclass="docutils literal notranslate"><spanclass="pre">OSError:</span><spanclass="pre">[Errno</span><spanclass="pre">98]</span></code> or <codeclass="docutils literal notranslate"><spanclass="pre">OSError:</span><spanclass="pre">[WinError</span><spanclass="pre">10013]</span></code> when the
server tries to start. See <aclass="reference internal"href="server.html#address-already-in-use"><spanclass="std std-ref">Address already in use</span></a> for how to
<p>If you run the server you will notice that the server is only accessible
from your own computer, not from any other in the network. This is the
default because in debugging mode a user of the application can execute
arbitrary Python code on your computer.</p>
<p>If you have the debugger disabled or trust the users on your network,
you can make the server publicly available simply by adding
<codeclass="docutils literal notranslate"><spanclass="pre">--host=0.0.0.0</span></code> to the command line:</p>
<divclass="highlight-default notranslate"><divclass="highlight"><pre><span></span>$ flask run --host=0.0.0.0
</pre></div>
</div>
<p>This tells your operating system to listen on all public IPs.</p>
</div>
</section>
<sectionid="debug-mode">
<h2>Debug Mode<aclass="headerlink"href="#debug-mode"title="Link to this heading">¶</a></h2>
<p>The <codeclass="docutils literal notranslate"><spanclass="pre">flask</span><spanclass="pre">run</span></code> command can do more than just start the development
server. By enabling debug mode, the server will automatically reload if
code changes, and will show an interactive debugger in the browser if an
error occurs during a request.</p>
<imgalt="The interactive debugger in action."class="screenshot align-center"src="_images/debugger.png"/>
<divclass="admonition warning">
<pclass="admonition-title">Warning</p>
<p>The debugger allows executing arbitrary Python code from the
browser. It is protected by a pin, but still represents a major
security risk. Do not run the development server or debugger in a
production environment.</p>
</div>
<p>To enable debug mode, use the <codeclass="docutils literal notranslate"><spanclass="pre">--debug</span></code> option.</p>
<divclass="highlight-text notranslate"><divclass="highlight"><pre><span></span>$ flask --app hello run --debug
* Serving Flask app 'hello'
* Debug mode: on
* Running on http://127.0.0.1:5000 (Press CTRL+C to quit)
* Restarting with stat
* Debugger is active!
* Debugger PIN: nnn-nnn-nnn
</pre></div>
</div>
<p>See also:</p>
<ulclass="simple">
<li><p><aclass="reference internal"href="server.html"><spanclass="doc">Development Server</span></a> and <aclass="reference internal"href="cli.html"><spanclass="doc">Command Line Interface</span></a> for information about running in debug mode.</p></li>
<li><p><aclass="reference internal"href="debugging.html"><spanclass="doc">Debugging Application Errors</span></a> for information about using the built-in debugger
and other debuggers.</p></li>
<li><p><aclass="reference internal"href="logging.html"><spanclass="doc">Logging</span></a> and <aclass="reference internal"href="errorhandling.html"><spanclass="doc">Handling Application Errors</span></a> to log errors and display
nice error pages.</p></li>
</ul>
</section>
<sectionid="html-escaping">
<h2>HTML Escaping<aclass="headerlink"href="#html-escaping"title="Link to this heading">¶</a></h2>
<p>When returning HTML (the default response type in Flask), any
user-provided values rendered in the output must be escaped to protect
from injection attacks. HTML templates rendered with Jinja, introduced
later, will do this automatically.</p>
<p><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">escape()</span></code>, shown here, can be used manually. It is
omitted in most examples for brevity, but you should always be aware of
<p>If a user managed to submit the name <codeclass="docutils literal notranslate"><spanclass="pre"><script>alert("bad")</script></span></code>,
escaping causes it to be rendered as text, rather than running the
script in the user’s browser.</p>
<p><codeclass="docutils literal notranslate"><spanclass="pre"><name></span></code> in the route captures a value from the URL and passes it to
the view function. These variable rules are explained below.</p>
</section>
<sectionid="routing">
<h2>Routing<aclass="headerlink"href="#routing"title="Link to this heading">¶</a></h2>
<p>Modern web applications use meaningful URLs to help users. Users are more
likely to like a page and come back if the page uses a meaningful URL they can
remember and use to directly visit a page.</p>
<p>Use the <aclass="reference internal"href="api.html#flask.Flask.route"title="flask.Flask.route"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">route()</span></code></a> decorator to bind a function to a URL.</p>
<p>You can do more! You can make parts of the URL dynamic and attach multiple
rules to a function.</p>
<sectionid="variable-rules">
<h3>Variable Rules<aclass="headerlink"href="#variable-rules"title="Link to this heading">¶</a></h3>
<p>You can add variable sections to a URL by marking sections with
<codeclass="docutils literal notranslate"><spanclass="pre"><variable_name></span></code>. Your function then receives the <codeclass="docutils literal notranslate"><spanclass="pre"><variable_name></span></code>
as a keyword argument. Optionally, you can use a converter to specify the type
of the argument like <codeclass="docutils literal notranslate"><spanclass="pre"><converter:variable_name></span></code>.</p>
<spanid="id1"></span><h3>URL Building<aclass="headerlink"href="#url-building"title="Link to this heading">¶</a></h3>
<p>To build a URL to a specific function, use the <aclass="reference internal"href="api.html#flask.url_for"title="flask.url_for"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">url_for()</span></code></a> function.
It accepts the name of the function as its first argument and any number of
keyword arguments, each corresponding to a variable part of the URL rule.
Unknown variable parts are appended to the URL as query parameters.</p>
<p>Why would you want to build URLs using the URL reversing function
<aclass="reference internal"href="api.html#flask.url_for"title="flask.url_for"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">url_for()</span></code></a> instead of hard-coding them into your templates?</p>
<p>For example, here we use the <aclass="reference internal"href="api.html#flask.Flask.test_request_context"title="flask.Flask.test_request_context"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">test_request_context()</span></code></a> method
to try out <aclass="reference internal"href="api.html#flask.url_for"title="flask.url_for"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">url_for()</span></code></a>. <aclass="reference internal"href="api.html#flask.Flask.test_request_context"title="flask.Flask.test_request_context"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">test_request_context()</span></code></a>
tells Flask to behave as though it’s handling a request even while we use a
Python shell. See <aclass="reference internal"href="#context-locals"><spanclass="std std-ref">Context Locals</span></a>.</p>
<h3>HTTP Methods<aclass="headerlink"href="#http-methods"title="Link to this heading">¶</a></h3>
<p>Web applications use different HTTP methods when accessing URLs. You should
familiarize yourself with the HTTP methods as you work with Flask. By default,
a route only answers to <codeclass="docutils literal notranslate"><spanclass="pre">GET</span></code> requests. You can use the <codeclass="docutils literal notranslate"><spanclass="pre">methods</span></code> argument
of the <aclass="reference internal"href="api.html#flask.Flask.route"title="flask.Flask.route"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">route()</span></code></a> decorator to handle different HTTP methods.</p>
<p>If <codeclass="docutils literal notranslate"><spanclass="pre">GET</span></code> is present, Flask automatically adds support for the <codeclass="docutils literal notranslate"><spanclass="pre">HEAD</span></code> method
and handles <codeclass="docutils literal notranslate"><spanclass="pre">HEAD</span></code> requests according to the <aclass="reference external"href="https://www.ietf.org/rfc/rfc2068.txt">HTTP RFC</a>. Likewise,
<codeclass="docutils literal notranslate"><spanclass="pre">OPTIONS</span></code> is automatically implemented for you.</p>
</section>
</section>
<sectionid="static-files">
<h2>Static Files<aclass="headerlink"href="#static-files"title="Link to this heading">¶</a></h2>
<p>Dynamic web applications also need static files. That’s usually where
the CSS and JavaScript files are coming from. Ideally your web server is
configured to serve them for you, but during development Flask can do that
as well. Just create a folder called <codeclass="file docutils literal notranslate"><spanclass="pre">static</span></code> in your package or next to
your module and it will be available at <codeclass="docutils literal notranslate"><spanclass="pre">/static</span></code> on the application.</p>
<p>To generate URLs for static files, use the special <codeclass="docutils literal notranslate"><spanclass="pre">'static'</span></code> endpoint name:</p>
<p>The file has to be stored on the filesystem as <codeclass="file docutils literal notranslate"><spanclass="pre">static/style.css</span></code>.</p>
</section>
<sectionid="rendering-templates">
<h2>Rendering Templates<aclass="headerlink"href="#rendering-templates"title="Link to this heading">¶</a></h2>
<p>Generating HTML from within Python is not fun, and actually pretty
cumbersome because you have to do the HTML escaping on your own to keep
the application secure. Because of that Flask configures the <aclass="reference external"href="https://palletsprojects.com/p/jinja/">Jinja2</a> template engine for you automatically.</p>
<p>Templates can be used to generate any type of text file. For web applications, you’ll
primarily be generating HTML pages, but you can also generate markdown, plain text for
emails, and anything else.</p>
<p>For a reference to HTML, CSS, and other web APIs, use the <aclass="reference external"href="https://developer.mozilla.org/">MDN Web Docs</a>.</p>
<p>To render a template you can use the <aclass="reference internal"href="api.html#flask.render_template"title="flask.render_template"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">render_template()</span></code></a>
method. All you have to do is provide the name of the template and the
variables you want to pass to the template engine as keyword arguments.
Here’s a simple example of how to render a template:</p>
<p>For templates you can use the full power of Jinja2 templates. Head over
to the official <aclass="reference external"href="https://jinja.palletsprojects.com/templates/">Jinja2 Template Documentation</a> for more information.</p>
<spanclass="p"><</span><spanclass="nt">title</span><spanclass="p">></span>Hello from Flask<spanclass="p"></</span><spanclass="nt">title</span><spanclass="p">></span>
<p>Inside templates you also have access to the <aclass="reference internal"href="api.html#flask.Flask.config"title="flask.Flask.config"><codeclass="xref py py-data docutils literal notranslate"><spanclass="pre">config</span></code></a>,
as well as the <aclass="reference internal"href="api.html#flask.url_for"title="flask.url_for"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">url_for()</span></code></a> and <aclass="reference internal"href="api.html#flask.get_flashed_messages"title="flask.get_flashed_messages"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">get_flashed_messages()</span></code></a> functions.</p>
<p>Templates are especially useful if inheritance is used. If you want to
know how that works, see <aclass="reference internal"href="patterns/templateinheritance.html"><spanclass="doc">Template Inheritance</span></a>. Basically
template inheritance makes it possible to keep certain elements on each
page (like header, navigation and footer).</p>
<p>Automatic escaping is enabled, so if <codeclass="docutils literal notranslate"><spanclass="pre">person</span></code> contains HTML it will be escaped
automatically. If you can trust a variable and you know that it will be
safe HTML (for example because it came from a module that converts wiki
markup to HTML) you can mark it as safe by using the
<codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Markup</span></code> class or by using the <codeclass="docutils literal notranslate"><spanclass="pre">|safe</span></code> filter in the
template. Head over to the Jinja 2 documentation for more examples.</p>
<p>Here is a basic introduction to how the <codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Markup</span></code> class works:</p>
<codeclass="docutils literal notranslate"><spanclass="pre">.xml</span></code>, <codeclass="docutils literal notranslate"><spanclass="pre">.xhtml</span></code>. Templates loaded from a string will have
<p>Unsure what that <aclass="reference internal"href="api.html#flask.g"title="flask.g"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">g</span></code></a> object is? It’s something in which
you can store information for your own needs. See the documentation
for <aclass="reference internal"href="api.html#flask.g"title="flask.g"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">flask.g</span></code></a> and <aclass="reference internal"href="patterns/sqlite3.html"><spanclass="doc">Using SQLite 3 with Flask</span></a>.</p>
</aside>
</aside>
</section>
<sectionid="accessing-request-data">
<h2>Accessing Request Data<aclass="headerlink"href="#accessing-request-data"title="Link to this heading">¶</a></h2>
<p>For web applications it’s crucial to react to the data a client sends to
the server. In Flask this information is provided by the global
<aclass="reference internal"href="api.html#flask.request"title="flask.request"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">request</span></code></a> object. If you have some experience with Python
you might be wondering how that object can be global and how Flask
manages to still be threadsafe. The answer is context locals:</p>
<sectionid="context-locals">
<spanid="id4"></span><h3>Context Locals<aclass="headerlink"href="#context-locals"title="Link to this heading">¶</a></h3>
<p>If you want to understand how that works and how you can implement
tests with context locals, read this section, otherwise just skip it.</p>
</div>
<p>Certain objects in Flask are global objects, but not of the usual kind.
These objects are actually proxies to objects that are local to a specific
context. What a mouthful. But that is actually quite easy to understand.</p>
<p>Imagine the context being the handling thread. A request comes in and the
web server decides to spawn a new thread (or something else, the
underlying object is capable of dealing with concurrency systems other
than threads). When Flask starts its internal request handling it
figures out that the current thread is the active context and binds the
current application and the WSGI environments to that context (thread).
It does that in an intelligent way so that one application can invoke another
application without breaking.</p>
<p>So what does this mean to you? Basically you can completely ignore that
this is the case unless you are doing something like unit testing. You
will notice that code which depends on a request object will suddenly break
because there is no request object. The solution is creating a request
object yourself and binding it to the context. The easiest solution for
unit testing is to use the <aclass="reference internal"href="api.html#flask.Flask.test_request_context"title="flask.Flask.test_request_context"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">test_request_context()</span></code></a>
context manager. In combination with the <codeclass="docutils literal notranslate"><spanclass="pre">with</span></code> statement it will bind a
test request so that you can interact with it. Here is an example:</p>
<h3>The Request Object<aclass="headerlink"href="#the-request-object"title="Link to this heading">¶</a></h3>
<p>The request object is documented in the API section and we will not cover
it here in detail (see <aclass="reference internal"href="api.html#flask.Request"title="flask.Request"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Request</span></code></a>). Here is a broad overview of
some of the most common operations. First of all you have to import it from
the <codeclass="docutils literal notranslate"><spanclass="pre">flask</span></code> module:</p>
<p>The current request method is available by using the
<aclass="reference internal"href="api.html#flask.Request.method"title="flask.Request.method"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">method</span></code></a> attribute. To access form data (data
transmitted in a <codeclass="docutils literal notranslate"><spanclass="pre">POST</span></code> or <codeclass="docutils literal notranslate"><spanclass="pre">PUT</span></code> request) you can use the
<aclass="reference internal"href="api.html#flask.Request.form"title="flask.Request.form"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">form</span></code></a> attribute. Here is a full example of the two
<p>What happens if the key does not exist in the <codeclass="docutils literal notranslate"><spanclass="pre">form</span></code> attribute? In that
case a special <aclass="reference external"href="https://docs.python.org/3/library/exceptions.html#KeyError"title="(in Python v3.13)"><codeclass="xref py py-exc docutils literal notranslate"><spanclass="pre">KeyError</span></code></a> is raised. You can catch it like a
standard <aclass="reference external"href="https://docs.python.org/3/library/exceptions.html#KeyError"title="(in Python v3.13)"><codeclass="xref py py-exc docutils literal notranslate"><spanclass="pre">KeyError</span></code></a> but if you don’t do that, a HTTP 400 Bad Request
error page is shown instead. So for many situations you don’t have to
deal with that problem.</p>
<p>To access parameters submitted in the URL (<codeclass="docutils literal notranslate"><spanclass="pre">?key=value</span></code>) you can use the
<p>We recommend accessing URL parameters with <codeclass="code docutils literal notranslate"><spanclass="pre">get</span></code> or by catching the
<aclass="reference external"href="https://docs.python.org/3/library/exceptions.html#KeyError"title="(in Python v3.13)"><codeclass="xref py py-exc docutils literal notranslate"><spanclass="pre">KeyError</span></code></a> because users might change the URL and presenting them a 400
bad request page in that case is not user friendly.</p>
<p>For a full list of methods and attributes of the request object, head over
to the <aclass="reference internal"href="api.html#flask.Request"title="flask.Request"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Request</span></code></a> documentation.</p>
</section>
<sectionid="file-uploads">
<h3>File Uploads<aclass="headerlink"href="#file-uploads"title="Link to this heading">¶</a></h3>
<p>You can handle uploaded files with Flask easily. Just make sure not to
forget to set the <codeclass="docutils literal notranslate"><spanclass="pre">enctype="multipart/form-data"</span></code> attribute on your HTML
form, otherwise the browser will not transmit your files at all.</p>
<p>Uploaded files are stored in memory or at a temporary location on the
filesystem. You can access those files by looking at the
<codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">files</span></code> attribute on the request object. Each
uploaded file is stored in that dictionary. It behaves just like a
standard Python <codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">file</span></code> object, but it also has a
<p>For some better examples, see <aclass="reference internal"href="patterns/fileuploads.html"><spanclass="doc">Uploading Files</span></a>.</p>
</section>
<sectionid="cookies">
<h3>Cookies<aclass="headerlink"href="#cookies"title="Link to this heading">¶</a></h3>
<p>To access cookies you can use the <aclass="reference internal"href="api.html#flask.Request.cookies"title="flask.Request.cookies"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">cookies</span></code></a>
attribute. To set cookies you can use the
<aclass="reference internal"href="api.html#flask.Response.set_cookie"title="flask.Response.set_cookie"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">set_cookie</span></code></a> method of response objects. The
<aclass="reference internal"href="api.html#flask.Request.cookies"title="flask.Request.cookies"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">cookies</span></code></a> attribute of request objects is a
dictionary with all the cookies the client transmits. If you want to use
sessions, do not use the cookies directly but instead use the
<aclass="reference internal"href="#sessions"><spanclass="std std-ref">Sessions</span></a> in Flask that add some security on top of cookies for you.</p>
<p>Note that cookies are set on response objects. Since you normally
just return strings from the view functions Flask will convert them into
response objects for you. If you explicitly want to do that you can use
the <aclass="reference internal"href="api.html#flask.make_response"title="flask.make_response"><codeclass="xref py py-meth docutils literal notranslate"><spanclass="pre">make_response()</span></code></a> function and then modify it.</p>
<p>Sometimes you might want to set a cookie at a point where the response
object does not exist yet. This is possible by utilizing the
<p>For this also see <aclass="reference internal"href="#about-responses"><spanclass="std std-ref">About Responses</span></a>.</p>
</section>
</section>
<sectionid="redirects-and-errors">
<h2>Redirects and Errors<aclass="headerlink"href="#redirects-and-errors"title="Link to this heading">¶</a></h2>
<p>To redirect a user to another endpoint, use the <aclass="reference internal"href="api.html#flask.redirect"title="flask.redirect"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">redirect()</span></code></a>
function; to abort a request early with an error code, use the
<p>Note the <codeclass="docutils literal notranslate"><spanclass="pre">404</span></code> after the <aclass="reference internal"href="api.html#flask.render_template"title="flask.render_template"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">render_template()</span></code></a> call. This
tells Flask that the status code of that page should be 404 which means
not found. By default 200 is assumed which translates to: all went well.</p>
<p>See <aclass="reference internal"href="errorhandling.html"><spanclass="doc">Handling Application Errors</span></a> for more details.</p>
<spanid="id5"></span><h2>About Responses<aclass="headerlink"href="#about-responses"title="Link to this heading">¶</a></h2>
<p>The return value from a view function is automatically converted into
a response object for you. If the return value is a string it’s
converted into a response object with the string as response body, a
<codeclass="docutils literal notranslate"><spanclass="pre">200</span><spanclass="pre">OK</span></code> status code and a <emclass="mimetype">text/html</em> mimetype. If the
return value is a dict or list, <codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">jsonify()</span></code> is called to produce a
response. The logic that Flask applies to converting return values into
response objects is as follows:</p>
<olclass="arabic simple">
<li><p>If a response object of the correct type is returned it’s directly
returned from the view.</p></li>
<li><p>If it’s a string, a response object is created with that data and
the default parameters.</p></li>
<li><p>If it’s an iterator or generator returning strings or bytes, it is
treated as a streaming response.</p></li>
<li><p>If it’s a dict or list, a response object is created using
<li><p>If a tuple is returned the items in the tuple can provide extra
information. Such tuples have to be in the form
<codeclass="docutils literal notranslate"><spanclass="pre">(response,</span><spanclass="pre">status)</span></code>, <codeclass="docutils literal notranslate"><spanclass="pre">(response,</span><spanclass="pre">headers)</span></code>, or
<codeclass="docutils literal notranslate"><spanclass="pre">(response,</span><spanclass="pre">status,</span><spanclass="pre">headers)</span></code>. The <codeclass="docutils literal notranslate"><spanclass="pre">status</span></code> value will override
the status code and <codeclass="docutils literal notranslate"><spanclass="pre">headers</span></code> can be a list or dictionary of
additional header values.</p></li>
<li><p>If none of that works, Flask will assume the return value is a
valid WSGI application and convert that into a response object.</p></li>
</ol>
<p>If you want to get hold of the resulting response object inside the view
you can use the <aclass="reference internal"href="api.html#flask.make_response"title="flask.make_response"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">make_response()</span></code></a> function.</p>
<p>You just need to wrap the return expression with
<aclass="reference internal"href="api.html#flask.make_response"title="flask.make_response"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">make_response()</span></code></a> and get the response object to modify it, then
<aclass="reference internal"href="api.html#flask.json.jsonify"title="flask.json.jsonify"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">jsonify()</span></code></a> function, which will serialize any supported
JSON data type. That means that all the data in the dict or list must be
JSON serializable.</p>
<p>For complex types such as database models, you’ll want to use a
serialization library to convert the data to valid JSON types first.
There are many serialization libraries and Flask API extensions
maintained by the community that support more complex applications.</p>
</section>
</section>
<sectionid="sessions">
<spanid="id6"></span><h2>Sessions<aclass="headerlink"href="#sessions"title="Link to this heading">¶</a></h2>
<p>In addition to the request object there is also a second object called
<aclass="reference internal"href="api.html#flask.session"title="flask.session"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">session</span></code></a> which allows you to store information specific to a
user from one request to the next. This is implemented on top of cookies
for you and signs the cookies cryptographically. What this means is that
the user could look at the contents of your cookie but not modify it,
unless they know the secret key used for signing.</p>
<p>In order to use sessions you have to set a secret key. Here is how
<spanclass="k">return</span><spanclass="sa">f</span><spanclass="s1">'Logged in as </span><spanclass="si">{</span><spanclass="n">session</span><spanclass="p">[</span><spanclass="s2">"username"</span><spanclass="p">]</span><spanclass="si">}</span><spanclass="s1">'</span>
<spanclass="k">return</span><spanclass="s1">'You are not logged in'</span>
<p>A note on cookie-based sessions: Flask will take the values you put into the
session object and serialize them into a cookie. If you are finding some
values do not persist across requests, cookies are indeed enabled, and you are
not getting a clear error message, check the size of the cookie in your page
responses compared to the size supported by web browsers.</p>
<p>Besides the default client-side based sessions, if you want to handle
sessions on the server-side instead, there are several
Flask extensions that support this.</p>
</section>
<sectionid="message-flashing">
<h2>Message Flashing<aclass="headerlink"href="#message-flashing"title="Link to this heading">¶</a></h2>
<p>Good applications and user interfaces are all about feedback. If the user
does not get enough feedback they will probably end up hating the
application. Flask provides a really simple way to give feedback to a
user with the flashing system. The flashing system basically makes it
possible to record a message at the end of a request and access it on the next
(and only the next) request. This is usually combined with a layout
template to expose the message.</p>
<p>To flash a message use the <aclass="reference internal"href="api.html#flask.flash"title="flask.flash"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">flash()</span></code></a> method, to get hold of the
messages you can use <aclass="reference internal"href="api.html#flask.get_flashed_messages"title="flask.get_flashed_messages"><codeclass="xref py py-func docutils literal notranslate"><spanclass="pre">get_flashed_messages()</span></code></a> which is also
available in the templates. See <aclass="reference internal"href="patterns/flashing.html"><spanclass="doc">Message Flashing</span></a> for a full
example.</p>
</section>
<sectionid="logging">
<h2>Logging<aclass="headerlink"href="#logging"title="Link to this heading">¶</a></h2>
<p><spanclass="versionmodified added">Added in version 0.3.</span></p>
</div>
</details><p>Sometimes you might be in a situation where you deal with data that
should be correct, but actually is not. For example you may have
some client-side code that sends an HTTP request to the server
but it’s obviously malformed. This might be caused by a user tampering
with the data, or the client code failing. Most of the time it’s okay
to reply with <codeclass="docutils literal notranslate"><spanclass="pre">400</span><spanclass="pre">Bad</span><spanclass="pre">Request</span></code> in that situation, but sometimes
that won’t do and the code has to continue working.</p>
<p>You may still want to log that something fishy happened. This is where
loggers come in handy. As of Flask 0.3 a logger is preconfigured for you
to use.</p>
<p>Here are some example log calls:</p>
<divclass="highlight-default notranslate"><divclass="highlight"><pre><span></span><spanclass="n">app</span><spanclass="o">.</span><spanclass="n">logger</span><spanclass="o">.</span><spanclass="n">debug</span><spanclass="p">(</span><spanclass="s1">'A value for debugging'</span><spanclass="p">)</span>
<p>The attached <aclass="reference internal"href="api.html#flask.Flask.logger"title="flask.Flask.logger"><codeclass="xref py py-attr docutils literal notranslate"><spanclass="pre">logger</span></code></a> is a standard logging
<aclass="reference external"href="https://docs.python.org/3/library/logging.html#logging.Logger"title="(in Python v3.13)"><codeclass="xref py py-class docutils literal notranslate"><spanclass="pre">Logger</span></code></a>, so head over to the official <aclass="reference external"href="https://docs.python.org/3/library/logging.html#module-logging"title="(in Python v3.13)"><codeclass="xref py py-mod docutils literal notranslate"><spanclass="pre">logging</span></code></a>
<p>Wrapping <codeclass="docutils literal notranslate"><spanclass="pre">app.wsgi_app</span></code> instead of <codeclass="docutils literal notranslate"><spanclass="pre">app</span></code> means that <codeclass="docutils literal notranslate"><spanclass="pre">app</span></code> still
points at your Flask application, not at the middleware, so you can
continue to use and configure <codeclass="docutils literal notranslate"><spanclass="pre">app</span></code> directly.</p>
</section>
<sectionid="using-flask-extensions">
<h2>Using Flask Extensions<aclass="headerlink"href="#using-flask-extensions"title="Link to this heading">¶</a></h2>
<p>Extensions are packages that help you accomplish common tasks. For
example, Flask-SQLAlchemy provides SQLAlchemy support that makes it simple
and easy to use with Flask.</p>
<p>For more on Flask extensions, see <aclass="reference internal"href="extensions.html"><spanclass="doc">Extensions</span></a>.</p>
</section>
<sectionid="deploying-to-a-web-server">
<h2>Deploying to a Web Server<aclass="headerlink"href="#deploying-to-a-web-server"title="Link to this heading">¶</a></h2>
<p>Ready to deploy your new Flask app? See <aclass="reference internal"href="deploying/index.html"><spanclass="doc">Deploying to Production</span></a>.</p>
