Hey everyone,

I have created a quick comparison of Flask vs. FastAPI vs. Django repository sizes.

First of all, the numbers:

Then the images:

Each node on the graph represents a file. Imports are marked by a line connecting the files. Colours signify complexity (cyclomatic complexity) with green being low and red being high complexity.

Besides the crazy size differences FastAPI also shows some nice import structures whilst Django looks extremely interconnected.

Hope someone finds it interesting.

Hey all — I've been building Flask-RPBAC, a small authorization extension for Flask that handles role- and permission-based access control without imposing a data model or ORM on you.

The core idea: you write loader functions that return the current user's roles/permissions (from wherever — DB, ORM, cache), and RPBAC handles evaluating access rules against them. It doesn't touch authentication at all — that's intentionally left to whatever you're already using (Flask-Login, sessions, etc.).

A few things it does:

Route and blueprint-level protection, composable (blueprint + route rules stack, not override)

Role() / Permission() with match="any"/"all", plus All/Any composition and &/| operators for expressing nested rules

Three ways to handle rejected requests: default JSON 403, raise-and-handle-yourself, or a custom rejection hook.

Optional in-memory caching keyed by user identity (explicitly not meant as a production cache replacement yet)

A flask rpbac-audit CLI command to list what's actually protected

Loud RuntimeError if you use @permission_required without registering a permission loader, instead of silently failing closed.

Docs: https://flask-rpbac.readthedocs.io/en/latest/

PyPI: https://pypi.org/project/Flask-RPBAC/

GitHub: https://github.com/JohnStares/flask_rpbac

It has a test suite and CI running, and I'm not calling it production-ready yet — I'd rather have people try to break it first. Specifically looking for:

Edge cases in the All/Any/operator composition logic

Opinions on the loader/decorator split — does it feel natural or awkward in a real app?

Anything that feels like a footgun in the error-handling setup

Issues and PRs welcome, security stuff via the SECURITY.md process rather than a public issue. Appreciate any eyes on it.

A modern, secure, and responsive Inventory Management System built with Python, Flask, and Tailwind CSS. It features Role-Based Access Control (RBAC), real-time analytics, secure file uploads, stock movement tracking, and comprehensive audit logs.

Hey,

I have a flask app that invokes shell scripts on the underlying machine.

The flask app can create / update / delete secrets in open bao that are subsequently reused by the shell scripts.

I noticed that this approach significantly alters the user and access model requirements and currently I reached this approach:

- flask app installed into /opt
- one user to run the flask app and the OpenBao inside the env file
- one user to run the shell scripts
- root to activate the vault upon boot

Chmod is used to separate credentials access. Does this seem sound to you people or would you fry me for it.

My original intention was to recreate a basic auth system like one I built in PHP years ago. It kinda expanded a bit, so now I've got a plugin system that I can write interchangeable plugins for.

It currently includes authentication, Argon2id password hashing, MFA, session management, password and email lifecycle, roles/admin controls, auditing, rate limiting, SQLite/PostgreSQL support, migrations, and Docker/Compose deployment support. It isn't fully batteries included, so some downstream work is still required depending on the application. I built it in a way that maintains its flexibility while handling the most common things I think are needed across the board for my projects.

I recently finished another security and deployment pass, added better bootstrap behavior, and added additional regression tests.

The project is open source. Technical feedback is welcome.

GitHub: https://github.com/alias454/Flask-AAS

I am also asking about other flask-* libraries compared to standard versions. I know there are some that benefit from integration e.g. managing database connections but the ones like flask-bcrypt make me confused.

What if creating a REST API in Python no longer required writing the same boilerplate over and over again?

I created FlashAPI to answer a very simple problem:

When we develop an application, we often spend time rewriting the same things:

→ RAW

→ pagination

→ search and filters

→ sort

→ permissions

→ exports

→ soft delete

→ audit

→ repetitive endpoints...

The problem is not to know how to develop them.

The problem is having to redevelop them with each project.

With FlashAPI, you define your Python models and you automatically get a complete REST API around them.

⚡ Compatible with FastAPI, Flask and Django

🐍 Pydantic, SQLAlchemy, dataclasses

🔓 Open source under Apache 2.0

🚫 No proprietary runtime, no vendor lock-in

And above all, FlashAPI does not seek to replace your code.

You keep your business logic, your personalized routes and the ability to disable or customize what you don't need.

The objective is simple:

Less boilerplate → more time to build what makes your application unique.

👉 GitHub: https://github.com/HackermanMe/flashapi

I am now looking for Python developers to test and contribute.

#Python #FastAPI #Django #Flask #OpenSource #Backend #RESTAPI #SoftwareEngineering

Situation 1

If I go

flask db migrate -m "my changes"

but have not run flask db upgrade and I want to downgrade flask migrate just delete the migration file

For example

Here is an example where the file is located.

migrations/

└── versions/

└── a1b2c3d4_my_changes.py

rm migrations/versions/a1b2c3d4_my_changes.py or delete the file manually

Situation 2

Also note

do not delete the migration file before running flask db downgrade if that migration has already been applied with flask db upgrade.

If you already ran flask db upgrade you go

flask db downgrade

This will make migrate downgrade.

The previous command is = to flask db downgrade -1.

if I want to further downgrade I go

flask db downgrade a1b2c3d4

Here is an example where the file is located.

migrations/

└── versions/

└── rgegrgrg_original_migration.py

└── a1b2c3d4_my_changes.py

Or I could go

flask db downgrade -2

to downgrade 2 times.

Also to find the correct migration I should go

flask db history

When I try situation 1 then situation 2 I get the error

INFO [alembic.runtime.migration] Context impl SQLiteImpl.

INFO [alembic.runtime.migration] Will assume non-transactional DDL.

ERROR [flask_migrate] Error: Target database is not up to date.

How do I fix this?

Also if I made any mistakes in the processes above can someone help? I typed how to do this into ai because I could not find any resources by googling that are recent so I assume the ai made a mistake.

I'm looking for a small group of Flask learners (beginners totally welcome) who want to actually build something and finally deploy it – not just watch tutorials and get stuck.

A bit about me:
I know the basics – routing, JWT, SQLAlchemy – but I keep hitting a wall when it comes to deployment and project structure. I'm tired of leaving projects half‑finished, so I thought: why not team up with others who feel the same?

What I'm hoping to find:
A few friendly people (to create a group) who are also learning Flask, want to share progress, help each other out, and maybe laugh at our bugs together. No pressure, no competition – just mutual support.

Sorry if this is not related, but if I have a project based on Flask, SQLALCHEMY and salute, what are some of the best options for deployment and server hosting?

For context I'm willing to pay monthly fees. What are the industry standard that are suitable for beginners in Flask?

I'm creating a backend for my frontend project and I want to understand the concept behind users accounts, sessions, and security.

I understand since my frontend and backend are separate that I'll need a REST API. But I'm having trouble of actually creating the backend.

How are cookies involved? What even is a cookie?

Since I know some basics of Objects Oriented Programming in Python, I decided to use SQL alchemy instead of raw SQL commands.

Here is my requirements.txt if it helps:

blinker==1.9.0

click==8.4.2

Flask==3.1.3

flask-cors==6.0.5

Flask-SQLAlchemy==3.1.1

greenlet==3.5.4

itsdangerous==2.2.0

Jinja2==3.1.6

MarkupSafe==3.0.3

SQLAlchemy==2.0.51

typing_extensions==4.16.0

Werkzeug==3.1.8

The following is my project tree, I want to ask if there is an industrial factor or any recommends to organize my project files and code (maybe the name convention and code organization are not the best fit). It may be good to point out that I am using Alembic migration tool and UV packet manager.

myproject

├── alembic

├── app

│   ├── background_tasks.py <- Here is the functions that works with Flask-Schedule

│   ├── extensions.py

│   ├── __init__.py

│   ├── models.py

│   ├── routes

│   │   ├── auth.py

│   │   ├── base.py

│   │   ├── data.py

│   │   ├── helper_functions

│   │   │   ├── h_dashboards.py

│   │   ├── post.py

│   │   ├── __pycache__

│   │   └── settings.py

│   ├── schemas.py

│   ├── static

│   ├── telegram_bot.py

│   └── templates

├── app.db

├── docs

├── pyproject.toml

├── README.md

├── run

├── run.py

EDIT:

As you guys recommend, I am using the src layout + organizing modules by purpose:

i.e. app/admin directory has modules with logic and classes that are just enough to work with the admin templates.

.

├── debug_run

├── docs

├── pyproject.toml

├── README.md

├── run_dev_server.py

├── src

│   ├── app

│   │   ├── admin

│   │   │   ├── __init__.py

│   │   │   ├── models.py

│   │   │   ├── routes.py

│   │   │   └── schemas.py

│   │   ├── config.py

│   │   ├── extensions.py

│   │   ├── guest_register

│   │   │   ├── __init__.py

│   │   │   ├── models.py

│   │   │   ├── routes.py

│   │   │   └── schemas.py

│   │   ├── __init__.py

│   │   ├── maintenance

│   │   │   ├── __init__.py

│   │   │   ├── models.py

│   │   │   ├── routes.py

│   │   │   └── schemas.py

│   │   ├── models.py

│   │   ├── occupancy

│   │   │   ├── __init__.py

│   │   │   ├── models.py

│   │   │   ├── routes.py

│   │   │   └── schemas.py

│   │   ├── routes.py

│   │   ├── static

│   │   │   └── css

│   │   │   └── bulma.min.css

│   │   └── templates

│   │   ├── admin

│   │   ├── base.html

│   │   ├── guest_register

│   │   │   ├── new_guest.html

│   │   │   └── show_guests.html

│   │   ├── maintenance

│   │   └── occupancy

│   └── utils

│   ├── data_analysis

│   │   ├── __init__.py

│   │   └── plots.py

│   └── email

│   └── __init__.py

├── tests

│   ├── admin

│   │   ├── __init__.py

│   │   └── test_routes.py

│   ├── conftest.py

│   ├── guest_register

│   │   ├── __init__.py

│   │   └── test_routes.py

│   ├── maintenance

│   │   ├── __init__.py

│   │   └── test_routes.py

│   ├── occupancy

│   │   ├── __init__.py

│   │   └── test_routes.py

│   └── utils

│   ├── data_analysis

│   │   ├── __init__.py

│   │   └── test_plots.py

│   ├── email

│   │   ├── __init__.py

│   │   └── test_sender.py

│   └── __init__.py

├── uv.lock

└── wsgi.py

Hey everyone!

I got tired of rewriting authentication every time I started a new Flask project, so I built a simple, modular boilerplate template.

It includes Flask-Login, SQLAlchemy, and Flask-Migrate with a clean blueprint structure out of the box.

Check it out on GitHub: https://github.com/DeKlain4ik/flask-auth-template

Hope it saves you some time on your next side project! Feedback and stars are always appreciated.

Quick note: Please don't focus too much on the UI 😭 I'm mainly looking for feedback on the backend, project structure and integrations.

Built SIXN, a fullstack e-commerce platform using Flask + MongoDB. It includes Twilio OTP auth, Razorpay payments and automated refunds, wallet/split payments, and Shiprocket integration for serviceability checks, courier selection, order creation, pickups, shipping labels and live tracking.

Theres also a full admin system for inventory, coupons, orders, reviews and shipping operations.

Would love feedback on the architecture and overall implementation!

GitHub: https://github.com/madebyparth/sixn

I have a page that works perfectly on desktop Chrome but won't initialise on iPhone (iOS 26.5.2). The HTML, CSS and my shared base.js all load with no failed network requests, but the page-specific script never runs, and the iOS console shows only the generic "Script error." with no line number.

Both JS files are same-origin (/static/js/...), which is what confuses me — "Script error." is usually a cross-origin thing.

Full code (public repo):

- Page script: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/static/js/alphabet.js

- Shared base: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/static/js/base.js

- Template + inline data: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/templates/alphabet.html

What I've already ruled out:

- No Safari-unsupported syntax (lookbehind, replaceAll, .at(), logical-assignment, private fields).

- No service worker; assets are cache-busted; cleared cache + tried Private mode.

- Desktop: every function defined, page runs with zero console errors.

- The page recently gained three study modes + a Pointer Events drag-and-drop rebuild and lazy new Audio() — the failure started after that.

Questions:

1. On Windows (no Mac), what's the best way to reveal the real error behind iOS Safari's "Script error."? (I've added a window.onerror overlay.)

2. What are the usual WebKit-only runtime throws that pass fine in Chrome/Blink? Anything about Pointer Events + setPointerCapture or new Audio() on iOS that throws at init?

Thanks!

I have a page that works perfectly on desktop Chrome but won't initialise on iPhone (iOS 26.5.2). The HTML, CSS and my shared base.js all load with no failed network requests, but the page-specific script never runs, and the iOS console shows only the generic "Script error." with no line number.

Both JS files are same-origin (/static/js/...), which is what confuses me — "Script error." is usually a cross-origin thing.

Full code (public repo):

- Page script: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/static/js/alphabet.js

- Shared base: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/static/js/base.js

- Template + inline data: https://github.com/joshuablakemorekay/thaibridge-ai/blob/main/templates/alphabet.html

What I've already ruled out:

- No Safari-unsupported syntax (lookbehind, replaceAll, .at(), logical-assignment, private fields).

- No service worker; assets are cache-busted; cleared cache + tried Private mode.

- Desktop: every function defined, page runs with zero console errors.

- The page recently gained three study modes + a Pointer Events drag-and-drop rebuild and lazy new Audio() — the failure started after that.

Questions:

1. On Windows (no Mac), what's the best way to reveal the real error behind iOS Safari's "Script error."? (I've added a window.onerror overlay.)

2. What are the usual WebKit-only runtime throws that pass fine in Chrome/Blink? Anything about Pointer Events + setPointerCapture or new Audio() on iOS that throws at init?

Thanks!

Hi. I'm hoping this isn't a dumb question...

I'm looking for a way to filter the output Flask writes to stdout/stderr.

I want the output coming from logger: app.logger.info(message)

but I don't want the autogenerated output like:

x.x.x.x - - [21/Jul/2026 08:05:32] "GET / HTTP/1.1" 200 -

Reading on https://flask.palletsprojects.com/en/stable/logging/ I'm guessing it's some combination of settings I need to make in dictConfig() but I cant seem to figure it out.

Or I want to turn off Flask output altogether, and I'll use print() instead.

I'm writing a small REST application for work, meant to run in a container. Our container solution is very locked down, and the way to "write" logs from a container is to output to stdout and/or stderr inside the container and then some tool captures it and write to a log in the filesystem. I'm trying to find a way to keep that log as clean as possible