Don't Panic — Flask Fundamentals

Flask is the bit of a Python web application that takes an HTTP request, finds the Python code responsible for it, and sends an HTTP response back. This sounds like a modest job because it is one. The important detail is that Flask keeps that job narrow, which means the database, authentication rules, background work, and deployment arrangement do not arrive in a crate marked solved.

The first useful map is WSGI, the interface through which a web server calls the Flask application. A request arrives, Flask compares its URL and method with registered rules, and a matching view produces the response. HTML, JSON, redirects, files, and errors all leave through that same boundary. Flask turns return values into HTTP responses; it does not inspect whether the request had permission to do the thing. That part remains application code, where it can be tested instead of admired from a distance.

The second map is context, Flask's way of making the current request and application available while work is active. request and session belong to a request. current_app and g belong to an application context. g is useful for request-scoped data such as a connection that teardown releases. It is not a tiny database wearing a false moustache. When code leaves the active context, it needs the required data passed to it deliberately.

A small application may begin in one module, then acquire an application factory that creates configured application instances and blueprints that group related routes. Blueprints are not miniature applications. They register on the main application, which remains the thing the WSGI server runs. This arrangement matters because setup must finish before workers start serving. Otherwise, different workers can discover different versions of reality, which is an inefficient way to create suspense.

Flask also makes several reassuring noises that need translating. Jinja autoescapes HTML templates, but untrusted data still needs a safe output context. A default session is signed, but its contents are not encrypted. JSON parsing gives the program data, not proof that the data is shaped correctly, meaningful, or authorized. The rest of the Course path explains these boundaries in detail: Intro traces a request and the application structure; Slides compress the relationships; Cheatsheet keeps the return values, contexts, and operating rules nearby; Quiz checks the vocabulary; Reference points to the authoritative details.

Finally, development is not deployment. flask run and the interactive debugger support local work, while production needs a WSGI server and the surrounding configuration for transport security, proxy behavior, logs, health checks, limits, and secrets. The compact map survives the journey: routes select views, contexts scope request data, views make responses, factories make applications, and the application owns the decisions Flask deliberately leaves open.