Flask Syllabus

What protection does Flask-WTF add to forms automatically, and what config value enables it?

It adds CSRF (Cross-Site Request Forgery) protection via a hidden token. It requires a SECRET_KEY to be set to sign the token.

Which extension is the standard way to integrate an ORM/database with Flask, and what does it wrap?

Flask-SQLAlchemy, which wraps the SQLAlchemy ORM/Core to provide models, sessions, and engine configuration integrated with the Flask app.

Which configuration key sets the database connection string in Flask-SQLAlchemy?

SQLALCHEMY_DATABASE_URI, e.g. 'sqlite:///app.db' or 'postgresql://user:pass@host/dbname'.

How do you define a database model with Flask-SQLAlchemy?

Subclass db.Model and declare columns as class attributes, e.g. id = db.Column(db.Integer, primary_key=True); name = db.Column(db.String(80)).

Which extension manages database schema migrations in Flask, and what tool does it wrap?

Flask-Migrate, which wraps Alembic. Typical commands: flask db init, flask db migrate, flask db upgrade.

What is the difference between db.session.add() and db.session.commit()?

add() stages a new/modified object in the session (pending). commit() flushes and permanently writes the pending changes to the database in a transaction.

Which extension provides user session management (login/logout) in Flask, and what does it require of a user model?

Flask-Login. The user model must implement is_authenticated, is_active, is_anonymous, and get_id() — most easily by inheriting from UserMixin.

What decorator from Flask-Login restricts a view to authenticated users only?

@login_required, applied below the route decorator.

Why should passwords never be stored in plaintext, and what utility does Werkzeug provide for hashing?

Plaintext passwords leak all credentials if the database is breached. Werkzeug provides generate_password_hash() to store a salted hash and check_password_hash() to verify a submitted password.

What is the purpose of Flask's SECRET_KEY, and what are the security requirements for it?

It signs session cookies and CSRF tokens (via itsdangerous). It must be a long, random, unpredictable value kept secret; a weak/leaked key lets attackers forge sessions.

How does Flask store session data by default, and what security property does it have?

Flask uses client-side cookie sessions: data is stored in a signed cookie. It is cryptographically signed (tamper-evident) but NOT encrypted, so users can read (but not modify) the contents.

Why must you NOT use Flask's built-in development server in production?

The dev server is single-threaded-ish, not built for performance, security, or stability under load. Production requires a proper WSGI server (Gunicorn, uWSGI) behind a reverse proxy.

Name two common production WSGI servers used to run Flask apps.

Gunicorn and uWSGI (also Waitress on Windows). They serve the WSGI callable with worker processes for concurrency.

What is the role of a reverse proxy like Nginx in front of a Flask/Gunicorn deployment?

Nginx handles incoming HTTP(S) connections, TLS termination, serving static files, load balancing, and buffering, then forwards dynamic requests to the WSGI server (Gunicorn), improving performance and security.

In Gunicorn, what is a common formula for choosing the number of worker processes?

$\text{workers} = (2 \times \text{CPU cores}) + 1$.

Why should FLASK_DEBUG (debug mode) be disabled in production?

Debug mode exposes the interactive Werkzeug debugger, which allows arbitrary code execution via the browser, and leaks stack traces / source code to attackers.

Name three categories of hosting options for deploying a Flask application.

1) PaaS (Platform-as-a-Service) like Heroku, Render, or Google App Engine; 2) IaaS / VPS like AWS EC2 or DigitalOcean droplets (self-managed); 3) Serverless like AWS Lambda (via Zappa) or Google Cloud Run.

What is containerization and which tool is most commonly used to containerize Flask apps?

Containerization packages an app with its dependencies and runtime into a portable, isolated image that runs consistently across environments. Docker is the most common tool.

What is a Dockerfile and what key instructions would a minimal Flask Dockerfile contain?

A Dockerfile is a text script defining how to build an image. A minimal Flask one uses: FROM python:3.x, WORKDIR, COPY requirements.txt, RUN pip install -r requirements.txt, COPY ., EXPOSE 5000, and CMD ["gunicorn", ...].

What is the difference between a Docker image and a Docker container?

An image is an immutable, read-only template/blueprint. A container is a running (or stopped) instance of an image with a writable layer on top.

What is Docker Compose used for in a Flask project?

It defines and runs multi-container setups (e.g., the Flask app plus a Postgres database and Redis) with a single docker-compose.yml file and 'docker compose up'.

What is the difference between unit testing and integration testing?

Unit tests verify a single function/component in isolation (often with mocked dependencies). Integration tests verify that multiple components work together correctly (e.g., a route hitting a real test database).

What Flask utility lets you send requests to your app in tests without running a live server?

The test client, obtained via app.test_client(). It simulates HTTP requests (client.get('/'), client.post(...)) and returns response objects to assert against.

Which Python testing framework is commonly paired with Flask, and what is a 'fixture'?

pytest. A fixture is a reusable setup function (decorated with @pytest.fixture) that provides test dependencies such as an app instance, test client, or database session.

Why should tests configure the app with TESTING = True and a separate test database?

TESTING = True disables error catching so exceptions propagate to the test, and using a separate (often in-memory SQLite) database prevents tests from corrupting real data and keeps them fast and isolated.

What is the Application Factory pattern in Flask and why is it useful?

A function (e.g., create_app(config)) that constructs and configures the Flask app instance and registers extensions/blueprints. It enables multiple configurations (testing vs prod), avoids global state, and simplifies testing.

What are Flask Blueprints and what problem do they solve?

Blueprints group related routes, templates, and static files into reusable modules. They let you organize a large application into components (e.g., auth, admin) and register them onto the app, avoiding one giant file.

List three common ways to load configuration in Flask.

1) app.config.from_object(ConfigClass); 2) app.config.from_pyfile('config.py'); 3) app.config.from_envvar / environment variables (or from_prefixed_env). Values can also be set directly on app.config.

Why should secrets and environment-specific config be kept out of source code, and how is this typically done?

To prevent leaking credentials in version control and to allow different values per environment. It is done via environment variables (often loaded from a .env file, excluded via .gitignore) rather than hardcoded values.

Name three key security best practices for a production Flask application.

1) Disable debug mode and set a strong random SECRET_KEY; 2) Serve over HTTPS/TLS and set secure cookie flags (Secure, HttpOnly, SameSite); 3) Prevent injection/XSS/CSRF by using the ORM (parameterized queries), Jinja2 autoescaping, and CSRF tokens.