undefined

undefined

undefined

Run: `uv run flask --app app run --debug`

---

undefined

**Status**: Will be fixed in Flask 3.2.0 as side effect of PR #5812. Until then, ensure all teardown callbacks are idempotent.

---

import asyncio
import gevent.monkey
import gevent.selectors
from flask import Flask

gevent.monkey.patch_all()
loop = asyncio.EventLoop(gevent.selectors.DefaultSelector())
gevent.spawn(loop.run_forever)

class GeventFlask(Flask):
    def async_to_sync(self, func):
        def run(*args, **kwargs):
            coro = func(*args, **kwargs)
            future = asyncio.run_coroutine_threadsafe(coro, loop)
            return future.result()
        return run

app = GeventFlask(__name__)

undefined

**Status**: Fixed in Flask 3.1.2. Upgrade to latest version.

---

from flask import current_app
import threading

**Verified**: Common pattern in production applications, documented in official Flask docs.

---

undefined

**Note**: By default, Flask-Login allows concurrent sessions (same user on multiple browsers). To prevent this, implement custom session tracking.

**Verified**: Official Flask-Login documentation, multiple 2024 blog posts.

---

undefined

**Verified**: Official Flask-WTF documentation warning, security best practices guides from 2024.

---

from flask import Flask, request

app = Flask(__name__)
app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16MB default

@app.route('/upload', methods=['POST'])
def upload():
    # Override for this specific route
    request.max_content_length = 100 * 1024 * 1024  # 100MB for uploads
    file = request.files['file']
    # ...

undefined

**Note**: Extensions need explicit support for this feature. Flask-Login and Flask-WTF may need updates to use fallback keys.

---

undefined

---

my-flask-app/
├── pyproject.toml
├── config.py                # Configuration classes
├── run.py                   # Entry point
│
├── app/
│   ├── __init__.py          # Application factory (create_app)
│   ├── extensions.py        # Flask extensions (db, login_manager)
│   ├── models.py            # SQLAlchemy models
│   │
│   ├── main/                # Main blueprint
│   │   ├── __init__.py
│   │   └── routes.py
│   │
│   ├── auth/                # Auth blueprint
│   │   ├── __init__.py
│   │   ├── routes.py
│   │   └── forms.py
│   │
│   ├── templates/
│   │   ├── base.html
│   │   ├── main/
│   │   └── auth/
│   │
│   └── static/
│       ├── css/
│       └── js/
│
└── tests/
    ├── conftest.py
    └── test_main.py

undefined

# Initialize extensions
db.init_app(app)
login_manager.init_app(app)

# Register blueprints
from app.main import bp as main_bp
from app.auth import bp as auth_bp

app.register_blueprint(main_bp)
app.register_blueprint(auth_bp, url_prefix="/auth")

# Create database tables
with app.app_context():
    db.create_all()

return app

**Key Benefits**:
- Multiple app instances with different configs (testing)
- Avoids circular imports
- Extensions initialized once, bound to app later

undefined

**Why separate file?**: Prevents circular imports - models can import `db` without importing `app`.

undefined

undefined

undefined

Run: `flask --app run run --debug`

---

undefined

```python

undefined

undefined

---

undefined

id = db.Column(db.Integer, primary_key=True)
email = db.Column(db.String(120), unique=True, nullable=False, index=True)
password_hash = db.Column(db.String(256), nullable=False)
is_active = db.Column(db.Boolean, default=True)
created_at = db.Column(db.DateTime, default=datetime.utcnow)

def set_password(self, password):
    self.password_hash = generate_password_hash(password)

def check_password(self, password):
    return check_password_hash(self.password_hash, password)

def __repr__(self):
    return f"<User {self.email}>"

---

undefined

def validate_email(self, field):
    if User.query.filter_by(email=field.data).first():
        raise ValidationError("Email already registered.")

undefined

undefined

form = RegistrationForm()
if form.validate_on_submit():
    user = User(email=form.email.data)
    user.set_password(form.password.data)
    db.session.add(user)
    db.session.commit()
    flash("Registration successful! Please log in.", "success")
    return redirect(url_for("auth.login"))

return render_template("auth/register.html", form=form)

form = LoginForm()
if form.validate_on_submit():
    user = User.query.filter_by(email=form.email.data).first()
    if user and user.check_password(form.password.data):
        login_user(user, remember=form.remember.data)
        next_page = request.args.get("next")
        flash("Logged in successfully!", "success")
        return redirect(next_page or url_for("main.index"))
    flash("Invalid email or password.", "danger")

return render_template("auth/login.html", form=form)

undefined

from flask_login import login_required, current_user

@bp.route("/dashboard")
@login_required
def dashboard():
    return render_template("main/dashboard.html", user=current_user)

undefined

```python

if User.query.filter_by(email=data["email"]).first():
    return jsonify({"error": "Email already exists"}), 409

user = User(email=data["email"])
user.set_password(data["password"])
db.session.add(user)
db.session.commit()

return jsonify({"id": user.id, "email": user.email}), 201

Register with prefix:
```python
app.register_blueprint(api_bp, url_prefix="/api/v1")

undefined

undefined

undefined

undefined

undefined

undefined

<form method="post">
    {{ form.hidden_tag() }}  <!-- Adds CSRF token -->
    <!-- form fields -->
</form>

undefined

```python

Run: `uv run pytest`

---

flask --app run run --debug

uv add gunicorn
uv run gunicorn -w 4 -b 0.0.0.0:8000 "run:app"

FROM python:3.12-slim

WORKDIR /app
COPY . .

RUN pip install uv && uv sync

EXPOSE 8000
CMD ["uv", "run", "gunicorn", "-w", "4", "-b", "0.0.0.0:8000", "run:app"]

SECRET_KEY=your-production-secret-key
DATABASE_URL=postgresql://user:pass@localhost/dbname
FLASK_ENV=production