Flask Cheat Sheet

Install & Run

Minimal Flask App

💡 Flask(__name__) — __name__ tells Flask where to find templates/static files.

Flask CLI Commands

Project Structure

Route Patterns & URL Converters 🔥

MethodView (Class-based)

request Object — All Properties 🔥

Building Responses

Sessions & Flash Messages

File Upload Pattern

Jinja2 Syntax Reference 🔥

base.html Template

render_template & Context

Config Patterns 🔥

Key Config Variables

create_app() Factory Pattern 🔥

Blueprints

Extensions Init Best Practice

💡 Separating extension instances into extensions.py avoids circular imports.

Model Definition 🔥

CRUD Operations

Querying & Filtering

Relationship Types

Migration Commands 🔥

Setup in create_app()

⚠️ Always review auto-generated migrations before running — Alembic can miss some changes.

Flask-Login Setup 🔥

Password Hashing

JWT Authentication (API) ⭐

Custom Decorators

Form Definition

Use Form in Route + Template

Complete REST API Pattern 🔥

CORS Setup

Standard API Response Format

Error Handlers 🔥

Request Lifecycle Hooks

g — Application Context Object

Application & Request Context

Extensions Quick Reference 🔥

Flask-Mail

Flask-Caching

Flask-Limiter

pytest Setup & Fixtures 🔥

Testing Routes

Testing Models & Factories

Common Imports Cheat Sheet 🔥

HTTP Status Codes Reference

Flask Gotchas & Pitfalls ⭐

Never use flask run in production — use Gunicorn: <code>gunicorn "app:create_app()"</code>
@app.route vs Blueprint route — in blueprints, use <code>@bp.route</code> not <code>@app.route</code>
url_for() needs blueprint prefix — <code>url_for('auth.login')</code> not <code>url_for('login')</code>
request is a proxy — only available inside a request context (view functions, hooks)
current_app is a proxy — only in app context; use <code>app.app_context()</code> in scripts
db.session.commit() after every write — or changes are lost; rollback on error
SECRET_KEY must be set — sessions and CSRF won't work without it
DEBUG=True leaks info — interactive debugger in browser exposes your code in dev
N+1 query problem — use <code>joinedload()</code> or <code>subqueryload()</code> for relationships
after_request must return response — forgetting the return breaks the response
form.validate_on_submit() — checks both POST method AND form validity
CORS on API only — apply CORS to your API blueprint, not the whole app

Security Checklist ⭐

Set a strong random SECRET_KEY — never hardcode it, use env var
Always hash passwords with bcrypt/pbkdf2 — never store plain text
Use Flask-WTF CSRF on all forms: <code>{{ form.hidden_tag() }}</code>
Escape all user output in templates — Jinja2 auto-escapes, but avoid <code>| safe</code>
Use prepared statements (SQLAlchemy ORM) — never interpolate raw SQL
Set httponly + secure + samesite on session cookies in production
Rate-limit login & register endpoints with Flask-Limiter
Use Flask-Talisman for HTTPS enforcement and security headers
Validate file uploads: secure_filename + allowed extension + finfo MIME check
Never expose DEBUG=True in production