Python Web 开发指南：Flask 框架从入门到实战 | 极客日志

Python

Python Web 开发指南：Flask 框架从入门到实战

Python Web 微框架 Flask 的核心概念与实战技巧。内容涵盖安装配置、路由系统、模板引擎 Jinja2、表单处理、数据库集成（Flask-SQLAlchemy）、用户认证授权、REST API 开发、蓝图应用结构以及生产环境部署（Gunicorn/Docker）。通过本指南，开发者可快速掌握 Flask 构建高效、安全 Web 应用的方法。

CoderByte发布于 2026/4/6更新于 2026/5/2423 浏览

Flask 框架从入门到实战指南

1. 引言

Flask 是 Python Web 开发领域最受欢迎的微框架之一，以其轻量、灵活和易于扩展的特性赢得了众多开发者的青睐。无论是构建简单的 API 服务，还是开发功能完备的 Web 应用，Flask 都能提供优雅而高效的解决方案。本文将全面介绍 Flask 框架的核心概念、基本用法和实战技巧，帮助读者快速掌握这一强大的 Web 开发工具。

无论你是 Web 开发新手，还是想从其他框架迁移到 Flask，这篇指南都将为你提供系统化的学习路径，帮助你构建专业、高效且安全的 Python Web 应用。

2. Flask 简介

2.1 什么是 Flask

Flask 是一个轻量级的 Python Web 应用框架，由 Armin Ronacher 设计开发，基于 Werkzeug WSGI 工具包和 Jinja2 模板引擎。Flask 被称为"微框架"，因为它保持核心简单但可扩展，不强制依赖特定的库或工具，给予开发者极大的灵活性和控制力。

Flask 的主要特点包括：

轻量且高效：核心简洁，启动迅速，资源占用低
灵活性：不强制特定项目结构或组件选择
易于学习：API 设计直观，学习曲线平缓
可扩展性：通过丰富的扩展生态系统增强功能
强大的路由系统：支持 URL 变量和 HTTP 方法
内置开发服务器：便于本地测试和开发
RESTful 支持：轻松构建符合 REST 规范的 API

2.2 Flask vs. Django

Flask 和 Django 是 Python Web 开发中最流行的两个框架，它们各有优势：

特性	Flask	Django
架构理念	微框架，灵活定制	全能框架，内置齐全
学习曲线	较低，容易上手	较高，概念较多
项目规模	适合小到中型项目	适合中到大型项目
自由度	高，可自由选择组件	低，遵循"Django 方式"
数据库支持	通过扩展支持	ORM 内置
管理后台	需要自行实现或使用扩展	内置强大的管理后台

2.3 安装 Flask

使用 pip 安装 Flask 非常简单：

pip install flask

建议在虚拟环境中安装 Flask，以避免依赖冲突：

# 创建虚拟环境
python -m venv venv
# 激活虚拟环境（Windows）
venv\Scripts\activate
# 激活虚拟环境（Linux/Mac）
source venv/bin/activate
# 安装 Flask
pip install flask

验证安装：

python -c "import flask; print(flask.__version__)"

from flask import Flask

# 创建 Flask 应用实例
app = Flask(__name__)

# 定义路由和视图函数
@app.route('/')
def hello_world():
    return 'Hello, World!'

# 启动应用
if __name__ == '__main__':
    app.run(debug=True)

python app.py

app = Flask(__name__)

@app.route('/user/<username>')
def show_user_profile(username):
    return f'User {username}'

@app.route('/post/<int:post_id>')
def show_post(post_id):
    return f'Post {post_id}'

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        # 处理表单提交
        return '处理登录'
    else:
        # 显示登录表单
        return '显示登录表单'

from flask import render_template, jsonify, redirect, url_for

@app.route('/template')
def template_example():
    return render_template('example.html', name='Flask')

@app.route('/api/data')
def api_data():
    return jsonify({"name": "Flask", "type": "framework"})

@app.route('/redirect')
def redirect_example():
    return redirect(url_for('hello_world'))

from flask import request

@app.route('/submit', methods=['POST'])
def submit():
    # 获取表单数据
    username = request.form.get('username')
    # 获取 URL 参数
    page = request.args.get('page', 1, type=int)
    # 获取 JSON 数据
    data = request.get_json()
    # 获取文件
    file = request.files.get('upload')
    return f'Received: {username}'

@app.route('/response')
def custom_response():
    return 'Custom response', 201, {'X-Custom-Header': 'value'}

from flask import make_response

@app.route('/cookie')
def set_cookie():
    resp = make_response('Cookie 设置成功')
    resp.set_cookie('username', 'flask_user')
    return resp

<!DOCTYPE html>
<html>
<head>
    <title>{{ title }}</title>
</head>
<body>
    <h1>Hello, {{ name }}!</h1>
    {% if messages %}
    <ul>
        {% for message in messages %}
        <li>{{ message }}</li>
        {% endfor %}
    </ul>
    {% else %}
    <p>No messages.</p>
    {% endif %}
</body>
</html>

@app.route('/')
def index():
    return render_template('index.html', title='Flask Template', name='User', messages=['Message 1', 'Message 2'])

{{ name|capitalize }}
{{ text|truncate(100) }}
{{ data|tojson }}

{% if user.is_authenticated %}
<a href="{{ url_for('logout') }}">Logout</a>
{% else %}
<a href="{{ url_for('login') }}">Login</a>
{% endif %}

<ul>
{% for item in items %}
<li>{{ loop.index }} - {{ item.name }}</li>
{% else %}
<li>No items found.</li>
{% endfor %}
</ul>

<!DOCTYPE html>
<html>
<head>
    <title>{% block title %}Default Title{% endblock %}</title>
    <link rel="stylesheet" href="{{ url_for('static', filename='style.css') }}">
    {% block styles %}{% endblock %}
</head>
<body>
<header>
    <nav>{% block nav %}{% endblock %}</nav>
</header>
<main>
    {% block content %}{% endblock %}
</main>
<footer>
    {% block footer %}© 2023 Flask 应用{% endblock %}
</footer>
{% block scripts %}{% endblock %}
</body>
</html>

{% extends "base.html" %}
{% block title %}页面标题{% endblock %}
{% block content %}
<h1>页面内容</h1>
<p>这是页面的具体内容。</p>
{% endblock %}

<link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
<img src="{{ url_for('static', filename='images/logo.png') }}">
<script src="{{ url_for('static', filename='js/script.js') }}"></script>

<a href="{{ url_for('index') }}">首页</a>
<a href="{{ url_for('user_profile', username='john') }}">用户资料</a>
<a href="{{ url_for('static', filename='style.css') }}">样式表</a>

from flask import request, redirect, url_for, render_template

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        # 验证用户名和密码
        if username == 'admin' and password == 'secret':
            return redirect(url_for('dashboard'))
        else:
            error = '无效的用户名或密码'
            return render_template('login.html', error=error)
    # GET 请求显示表单
    return render_template('login.html')

<!DOCTYPE html>
<html>
<head><title>登录</title></head>
<body>
<h1>登录</h1>
{% if error %}
<p style="color: red;">{{ error }}</p>
{% endif %}
<form method="post">
<div>
<label>用户名：</label>
<input type="text" name="username" required>
</div>
<div>
<label>密码：</label>
<input type="password" name="password" required>
</div>
<button type="submit">登录</button>
</form>
</body>
</html>

pip install flask-wtf

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key' # 用于 CSRF 保护

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Email, Length

class LoginForm(FlaskForm):
    email = StringField('邮箱', validators=[DataRequired(), Email()])
    password = PasswordField('密码', validators=[DataRequired(), Length(min=6)])
    submit = SubmitField('登录')

@app.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        # 表单验证通过
        email = form.email.data
        password = form.password.data
        # 处理登录逻辑
        return redirect(url_for('dashboard'))
    return render_template('login_wtf.html', form=form)

<!DOCTYPE html>
<html>
<head><title>登录</title></head>
<body>
<h1>登录</h1>
<form method="post">
{{ form.hidden_tag() }}
<div>
{{ form.email.label }} {{ form.email }}
{% if form.email.errors %}
<ul>
{% for error in form.email.errors %}
<li>{{ error }}</li>
{% endfor %}
</ul>
{% endif %}
</div>
<div>
{{ form.password.label }} {{ form.password }}
{% if form.password.errors %}
<ul>
{% for error in form.password.errors %}
<li>{{ error }}</li>
{% endfor %}
</ul>
{% endif %}
</div>
{{ form.submit }}
</form>
</body>
</html>

<form method="post" enctype="multipart/form-data">
<input type="file" name="file">
<button type="submit">上传</button>
</form>

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = 'uploads'
ALLOWED_EXTENSIONS = {'txt', 'pdf', 'png', 'jpg', 'jpeg', 'gif'}

app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

def allowed_file(filename):
    return '.' in filename and \
           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/upload', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        # 检查是否有文件部分
        if 'file' not in request.files:
            return '没有文件部分'
        file = request.files['file']
        # 如果用户未选择文件，浏览器会提交一个没有文件名的空部分
        if file.filename == '':
            return '未选择文件'
        if file and allowed_file(file.filename):
            filename = secure_filename(file.filename)
            file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
            return f'文件 {filename} 上传成功'
    return '''
    <!doctype html>
    <title>上传文件</title>
    <h1>上传文件</h1>
    <form method="post" enctype="multipart/form-data">
    <input type="file" name="file">
    <input type="submit" value="上传">
    </form>
    '''

from wtforms import ValidationError

class RegistrationForm(FlaskForm):
    username = StringField('用户名', validators=[DataRequired(), Length(min=4, max=20)])
    email = StringField('邮箱', validators=[DataRequired(), Email()])
    password = PasswordField('密码', validators=[DataRequired(), Length(min=6)])
    confirm_password = PasswordField('确认密码', validators=[DataRequired(), EqualTo('password')])
    submit = SubmitField('注册')

    def validate_username(self, username):
        # 检查用户名是否已存在
        if username.data == 'admin':
            raise ValidationError('该用户名已被使用，请选择其他用户名。')

pip install flask-sqlalchemy

from flask import Flask
from flask_sqlalchemy import SQLAlchemy

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///site.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
db = SQLAlchemy(app)

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    password = db.Column(db.String(60), nullable=False)
    # 一对多关系
    posts = db.relationship('Post', backref='author', lazy=True)

    def __repr__(self):
        return f"User('{self.username}', '{self.email}')"

class Post(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(100), nullable=False)
    content = db.Column(db.Text, nullable=False)
    date_posted = db.Column(db.DateTime, nullable=False, default=datetime.utcnow)
    # 外键
    user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False)

    def __repr__(self):
        return f"Post('{self.title}', '{self.date_posted}')"

# 在 Python 交互式 shell 中
from app import db
db.create_all()

pip install flask-migrate

from flask_migrate import Migrate
migrate = Migrate(app, db)

flask db init # 初始化迁移仓库
flask db migrate # 创建迁移脚本
flask db upgrade # 应用迁移到数据库

@app.route('/add_user', methods=['POST'])
def add_user():
    username = request.form.get('username')
    email = request.form.get('email')
    password = request.form.get('password')
    user = User(username=username, email=email, password=password)
    db.session.add(user)
    db.session.commit()
    return f'用户 {username} 已添加'

@app.route('/users')
def get_users():
    users = User.query.all()
    return render_template('users.html', users=users)

@app.route('/user/<int:user_id>')
def get_user(user_id):
    user = User.query.get_or_404(user_id)
    return render_template('user.html', user=user)

# 获取所有记录
User.query.all()
# 获取指定 ID 的记录
User.query.get(1)
User.query.get_or_404(1) # ID 不存在时返回 404 错误
# 条件查询
User.query.filter_by(username='john').first()
User.query.filter(User.email.endswith('@example.com')).all()
# 排序
User.query.order_by(User.username).all()
# 限制结果数量
User.query.limit(10).all()
# 分页
users = User.query.paginate(page=2, per_page=20)
for user in users.items:
    print(user.username)

@app.route('/update_user/<int:user_id>', methods=['POST'])
def update_user(user_id):
    user = User.query.get_or_404(user_id)
    user.username = request.form.get('username', user.username)
    user.email = request.form.get('email', user.email)
    db.session.commit()
    return f'用户 {user.username} 已更新'

@app.route('/delete_user/<int:user_id>', methods=['POST'])
def delete_user(user_id):
    user = User.query.get_or_404(user_id)
    db.session.delete(user)
    db.session.commit()
    return f'用户 {user.username} 已删除'

app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///site.db'

pip install mysqlclient

app.config['SQLALCHEMY_DATABASE_URI'] = 'mysql://username:password@localhost/db_name'

pip install psycopg2-binary

app.config['SQLALCHEMY_DATABASE_URI'] = 'postgresql://username:password@localhost/db_name'

pip install flask-mongoengine

from flask_mongoengine import MongoEngine

app = Flask(__name__)
app.config['MONGODB_SETTINGS'] = {
    'db': 'your_database',
    'host': 'localhost',
    'port': 27017
}
db = MongoEngine(app)

class User(db.Document):
    email = db.StringField(required=True, unique=True)
    username = db.StringField(required=True, unique=True)
    password = db.StringField(required=True)

pip install flask-login

from flask_login import LoginManager, UserMixin, login_user, logout_user, login_required, current_user

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

# 初始化 LoginManager
login_manager = LoginManager(app)
login_manager.login_view = 'login' # 未登录用户重定向的视图
login_manager.login_message = '请先登录再访问此页面。' # 自定义消息

# 加载用户回调函数
@login_manager.user_loader
def load_user(user_id):
    return User.query.get(int(user_id))

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    password = db.Column(db.String(60), nullable=False)
    # UserMixin 提供了以下方法：
    # is_authenticated, is_active, is_anonymous, get_id()

@app.route('/login', methods=['GET', 'POST'])
def login():
    if current_user.is_authenticated:
        return redirect(url_for('index'))
    form = LoginForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()
        if user and check_password(form.password.data, user.password):
            login_user(user, remember=form.remember.data)
            # 获取登录后重定向的页面
            next_page = request.args.get('next')
            if next_page:
                return redirect(next_page)
            else:
                return redirect(url_for('index'))
    else:
        flash('登录失败。请检查邮箱和密码。')
    return render_template('login.html', form=form)

@app.route('/logout')
def logout():
    logout_user()
    return redirect(url_for('login'))

@app.route('/profile')
@login_required
def profile():
    return render_template('profile.html')

{% if current_user.is_authenticated %}
<p>当前用户：{{ current_user.username }}</p>
<a href="{{ url_for('logout') }}">退出登录</a>
{% else %}
<a href="{{ url_for('login') }}">登录</a>
<a href="{{ url_for('register') }}">注册</a>
{% endif %}

pip install flask-bcrypt

from flask_bcrypt import Bcrypt
bcrypt = Bcrypt(app)

# 生成密码哈希
hashed_password = bcrypt.generate_password_hash('password').decode('utf-8')
# 验证密码
valid = bcrypt.check_password_hash(hashed_password, 'password') # 返回 True

@app.route('/register', methods=['GET', 'POST'])
def register():
    form = RegistrationForm()
    if form.validate_on_submit():
        hashed_password = bcrypt.generate_password_hash(form.password.data).decode('utf-8')
        user = User(username=form.username.data, email=form.email.data, password=hashed_password)
        db.session.add(user)
        db.session.commit()
        flash(f'账户已创建，现在可以登录了！')
        return redirect(url_for('login'))
    return render_template('register.html', form=form)

# 扩展 User 模型添加角色
class User(db.Model, UserMixin):
    # ...其他字段
    role = db.Column(db.String(20), nullable=False, default='user')

    def is_admin(self):
        return self.role == 'admin'

from functools import wraps
from flask import abort

def admin_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if not current_user.is_authenticated or not current_user.is_admin():
            abort(403) # 返回禁止访问
        return f(*args, **kwargs)
    return decorated_function

@app.route('/admin')
@login_required
@admin_required
def admin_panel():
    return render_template('admin/index.html')

pip install flask-security-too

from flask_security import Security, SQLAlchemyUserDatastore

# 定义安全相关的模型
class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(80), unique=True)
    description = db.Column(db.String(255))

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users, backref=db.backref('users', lazy='dynamic'))

# 初始化 Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

from flask import jsonify

@app.route('/api/users')
def get_users():
    users = User.query.all()
    user_list = []
    for user in users:
        user_data = {
            'id': user.id,
            'username': user.username,
            'email': user.email
        }
        user_list.append(user_data)
    return jsonify({'users': user_list})

@app.route('/api/user/<int:user_id>')
def get_user(user_id):
    user = User.query.get_or_404(user_id)
    user_data = {
        'id': user.id,
        'username': user.username,
        'email': user.email
    }
    return jsonify(user_data)

@app.route('/api/users', methods=['POST'])
def create_user():
    if not request.json or not 'username' in request.json:
        abort(400) # 错误请求
    user = User(
        username=request.json['username'],
        email=request.json.get('email', '')
    )
    db.session.add(user)
    db.session.commit()
    return jsonify({'user': {
        'id': user.id,
        'username': user.username,
        'email': user.email
    }}), 201 # 创建成功状态码

@app.route('/api/user/<int:user_id>', methods=['PUT'])
def update_user(user_id):
    user = User.query.get_or_404(user_id)
    if not request.json:
        abort(400)
    user.username = request.json.get('username', user.username)
    user.email = request.json.get('email', user.email)
    db.session.commit()
    return jsonify({'user': {
        'id': user.id,
        'username': user.username,
        'email': user.email
    }})

pip install flask-restful

from flask import Flask
from flask_restful import Api, Resource, reqparse, fields, marshal_with

app = Flask(__name__)
api = Api(app)

# 定义响应字段格式
user_fields = {
    'id': fields.Integer,
    'username': fields.String,
    'email': fields.String,
    'uri': fields.Url('user') # 生成资源 URL
}

# 请求解析器
user_parser = reqparse.RequestParser()
user_parser.add_argument('username', type=str, required=True, help='用户名不能为空')
user_parser.add_argument('email', type=str, required=True, help='邮箱不能为空')

# 用户资源
class UserResource(Resource):
    @marshal_with(user_fields)
    def get(self, user_id):
        user = User.query.get_or_404(user_id)
        return user

    @marshal_with(user_fields)
    def put(self, user_id):
        args = user_parser.parse_args()
        user = User.query.get_or_404(user_id)
        user.username = args['username']
        user.email = args['email']
        db.session.commit()
        return user

    def delete(self, user_id):
        user = User.query.get_or_404(user_id)
        db.session.delete(user)
        db.session.commit()
        return '', 204 # 无内容返回

# 用户列表资源
class UserListResource(Resource):
    @marshal_with(user_fields)
    def get(self):
        users = User.query.all()
        return users

    @marshal_with(user_fields)
    def post(self):
        args = user_parser.parse_args()
        user = User(username=args['username'], email=args['email'])
        db.session.add(user)
        db.session.commit()
        return user, 201

# 注册 API 路由
api.add_resource(UserListResource, '/api/users')
api.add_resource(UserResource, '/api/user/<int:user_id>', endpoint='user')

from flask_httpauth import HTTPBasicAuth

auth = HTTPBasicAuth()

@auth.verify_password
def verify_password(username, password):
    user = User.query.filter_by(username=username).first()
    if user and bcrypt.check_password_hash(user.password, password):
        return user
    return None

class ProtectedResource(Resource):
    @auth.login_required
    def get(self):
        return {'message': '只有认证用户才能看到'}

from flask_httpauth import HTTPTokenAuth
from itsdangerous import Serializer

auth = HTTPTokenAuth()

@auth.verify_token
def verify_token(token):
    # 验证令牌并返回用户
    user = User.verify_token(token)
    if user:
        return user
    return None

# 在 User 模型中生成令牌
class User(db.Model):
    # ...其他字段

    def generate_token(self, expiration=3600):
        s = Serializer(app.config['SECRET_KEY'], expires_in=expiration)
        return s.dumps({'id': self.id}).decode('utf-8')

    @staticmethod
    def verify_token(token):
        s = Serializer(app.config['SECRET_KEY'])
        try:
            data = s.loads(token)
        except:
            return None
        return User.query.get(data['id'])

pip install flask-restplus

from flask import Flask
from flask_restplus import Api, Resource, fields

app = Flask(__name__)
api = Api(app, version='1.0', title='用户 API', description='用户管理 API 文档')

# 定义命名空间
ns = api.namespace('users', description='用户操作')

# 定义模型
user_model = api.model('User', {
    'id': fields.Integer(readonly=True, description='用户 ID'),
    'username': fields.String(required=True, description='用户名'),
    'email': fields.String(required=True, description='邮箱地址')
})

@ns.route('/')
class UserList(Resource):
    @ns.doc('列出所有用户')
    @ns.marshal_list_with(user_model)
    def get(self):
        """获取所有用户列表"""
        return User.query.all()

    @ns.doc('创建用户')
    @ns.expect(user_model)
    @ns.marshal_with(user_model, code=201)
    def post(self):
        """创建新用户"""
        user = User(username=api.payload['username'], email=api.payload['email'])
        db.session.add(user)
        db.session.commit()
        return user, 201

@ns.route('/<int:id>')
@ns.response(404, '用户未找到')
@ns.param('id', '用户 ID')
class UserAPI(Resource):
    @ns.doc('获取用户')
    @ns.marshal_with(user_model)
    def get(self, id):
        """获取指定 ID 的用户"""
        return User.query.get_or_404(id)

@app.route('/api/v1/users')
def get_users_v1():
    # v1 版本实现
    pass

@app.route('/api/v2/users')
def get_users_v2():
    # v2 版本实现
    pass

from flask import Blueprint

api_v1 = Blueprint('api_v1', __name__, url_prefix='/api/v1')
api_v2 = Blueprint('api_v2', __name__, url_prefix='/api/v2')

@api_v1.route('/users')
def get_users_v1():
    # v1 版本实现
    pass

@api_v2.route('/users')
def get_users_v2():
    # v2 版本实现
    pass

app.register_blueprint(api_v1)
app.register_blueprint(api_v2)

from flask import Blueprint

# 创建蓝图实例
users_bp = Blueprint('users', __name__, url_prefix='/users')

# 定义蓝图路由
@users_bp.route('/')
def user_list():
    return 'User list'

@users_bp.route('/<int:user_id>')
def user_detail(user_id):
    return f'User {user_id} detail'

from flask import Flask

# 导入蓝图
from views.users import users_bp

app = Flask(__name__)

# 注册蓝图
app.register_blueprint(users_bp)

admin_bp = Blueprint('admin', __name__, url_prefix='/admin', template_folder='templates/admin', static_folder='static/admin')

@admin_bp.before_request
def restrict_to_admins():
    if not current_user.is_admin:
        abort(403)

from flask import Blueprint

main = Blueprint('main', __name__)
admin = Blueprint('admin', __name__, url_prefix='/admin')

@main.route('/')
def index():
    return 'Main index'

@admin.route('/')
def admin_index():
    return 'Admin index'

# 可以将两个蓝图组合为一个更大的蓝图
super_bp = Blueprint('super', __name__)
super_bp.register_blueprint(main)
super_bp.register_blueprint(admin)

# 然后注册到应用
app.register_blueprint(super_bp, url_prefix='/portal')

# app/__init__.py
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_login import LoginManager
from config import config

# 初始化扩展但不传递应用实例
db = SQLAlchemy()
login_manager = LoginManager()
login_manager.login_view = 'auth.login'

def create_app(config_name):
    app = Flask(__name__)
    app.config.from_object(config[config_name])

    # 初始化扩展
db.init_app(app)
login_manager.init_app(app)

    # 注册蓝图
from main import main as main_blueprint
from auth import auth as auth_blueprint
app.register_blueprint(main_blueprint)
app.register_blueprint(auth_blueprint, url_prefix='/auth')

return app

# config.py
import os

class Config:
    SECRET_KEY = os.environ.get('SECRET_KEY', 'hard-to-guess-string')
    SQLALCHEMY_TRACK_MODIFICATIONS = False

    @staticmethod
    def init_app(app):
        pass

class DevelopmentConfig(Config):
    DEBUG = True
    SQLALCHEMY_DATABASE_URI = os.environ.get('DEV_DATABASE_URL', 'sqlite:///dev.db')

class TestingConfig(Config):
    TESTING = True
    SQLALCHEMY_DATABASE_URI = os.environ.get('TEST_DATABASE_URL', 'sqlite:///:memory:')

class ProductionConfig(Config):
    SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL', 'sqlite:///prod.db')

config = {
    'development': DevelopmentConfig,
    'testing': TestingConfig,
    'production': ProductionConfig,
    'default': DevelopmentConfig
}

# run.py
import os
from app import create_app, db
from app.models import User, Role

app = create_app(os.getenv('FLASK_CONFIG', 'default'))

@app.shell_context_processor
def make_shell_context():
    return dict(db=db, User=User, Role=Role)

myapp/
├── app/
│   ├── __init__.py # 应用工厂
│   ├── models/ # 数据库模型
│   │   ├── __init__.py
│   │   ├── user.py
│   │   └── post.py
│   ├── views/ # 视图函数和蓝图
│   │   ├── __init__.py
│   │   ├── main.py
│   │   ├── auth.py
│   │   └── api.py
│   ├── forms/ # 表单类
│   │   ├── __init__.py
│   │   ├── auth.py
│   │   └── main.py
│   ├── static/ # 静态文件
│   │   ├── css/
│   │   ├── js/
│   │   └── img/
│   ├── templates/ # HTML 模板
│   │   ├── base.html
│   │   ├── main/
│   │   ├── auth/
│   │   └── errors/
│   └── utils/ # 工具函数
│       ├── __init__.py
│       └── helpers.py
├── migrations/ # 数据库迁移
├── tests/ # 测试用例
│   ├── __init__.py
│   ├── test_user.py
│   └── test_api.py
├── venv/ # 虚拟环境
├── config.py # 配置文件
├── requirements.txt # 依赖包列表
├── run.py # 应用入口
└── README.md # 项目说明

pip freeze > requirements.txt

# requirements/base.txt
flask==2.0.1
flask-sqlalchemy==2.5.1
flask-login==0.5.0

# requirements/dev.txt
-r base.txt
pytest==6.2.5
coverage==6.0.2

# requirements/prod.txt
-r base.txt
gunicorn==20.1.0

pip install -r requirements/dev.txt

from flask_caching import Cache

cache = Cache(app, config={'CACHE_TYPE': 'SimpleCache'})

@app.route('/expensive-operation')
@cache.cached(timeout=60) # 缓存 60 秒
def expensive_operation():
    # 复杂计算
    return result

import logging
logging.basicConfig(
    filename='app.log',
    level=logging.INFO,
    format='%(asctime)s %(levelname)s: %(message)s'
)

app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
app.config['DATABASE_URI'] = os.environ.get('DATABASE_URI')

app.run(debug=False)

pip install gunicorn

gunicorn -w 4 -b 127.0.0.1:5000 wsgi:app

pip install uwsgi

[uwsgi]
module = wsgi:app
master = true
processes = 4
socket = myapp.sock
chmod-socket = 660
vacuum = true
die-on-term = true

uwsgi --ini uwsgi.ini

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /static {
        alias /path/to/your/app/static;
    }
}

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

FROM python:3.9-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
ENV FLASK_APP=app
ENV FLASK_ENV=production
CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:5000", "wsgi:app"]

docker build -t flask-app .
docker run -p 5000:5000 -d flask-app

# docker-compose.yml
version: '3'
services:
  web:
    build: .
    ports:
      - "5000:5000"
    environment:
      - DATABASE_URI=postgresql://user:password@db:5432/app
    depends_on:
      - db
  db:
    image: postgres:13
    environment:
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=app
    volumes:
      - postgres_data:/var/lib/postgresql/data
volumes:
  postgres_data:

web: gunicorn wsgi:app

git push heroku master

import sys
path = '/home/yourusername/myapp'
if path not in sys.path:
    sys.path.append(path)
from app import create_app
application = create_app('production')

option_settings:
  aws:elasticbeanstalk:container:python:WSGIPath: wsgi:app

pip install prometheus-flask-exporter

from prometheus_flask_exporter import PrometheusMetrics
metrics = PrometheusMetrics(app)

pip install sentry-sdk[flask]

import sentry_sdk
from sentry_sdk.integrations.flask import FlaskIntegration

sentry_sdk.init(
    dsn="your-dsn-here",
    integrations=[FlaskIntegration()]
)

name: Deploy
on:
  push:
    branches: [ main ]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pytest
          pip install -r requirements.txt
      - name: Test with pytest
        run: |
          pytest
  deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Deploy to Heroku
        uses: akhileshns/[email protected]
        with:
          heroku_api_key: ${{secrets.HEROKU_API_KEY}}
          heroku_app_name: "your-app-name"
          heroku_email: "[email protected]"

Python Web 开发指南：Flask 框架从入门到实战

Flask 框架从入门到实战指南

1. 引言

2. Flask 简介

2.1 什么是 Flask

2.2 Flask vs. Django

2.3 安装 Flask

3. Flask 基础知识

3.1 第一个 Flask 应用

3.2 应用实例

3.3 路由系统

3.3.1 URL 变量

3.3.2 HTTP 方法

3.4 视图函数

3.5 请求对象

3.6 响应对象

4. 模板系统

4.1 Jinja2 模板基础

4.2 模板语法

4.2.1 变量与过滤器

4.2.2 控制结构

4.3 模板继承

4.4 静态文件

4.5 URL 生成

5. 表单处理

5.1 基本表单处理

5.2 使用 Flask-WTF 扩展

5.3 文件上传

5.4 表单验证

6. 数据库集成

6.1 Flask-SQLAlchemy 基础

6.2 定义模型

6.3 创建和迁移数据库

6.4 基本 CRUD 操作

创建记录

查询记录

更新记录

删除记录

6.5 使用其他数据库

SQLite

MySQL

PostgreSQL

MongoDB (NoSQL)

7. 用户认证与授权

7.1 Flask-Login 扩展

7.2 密码哈希

7.3 基于角色的访问控制

7.4 Flask-Security 扩展

8. REST API 开发

8.1 基本 API 端点

8.2 使用 Flask-RESTful 扩展

8.3 API 认证

基本认证

令牌认证

8.4 API 文档生成

8.5 API 版本控制

URL 路径版本控制

使用蓝图实现版本控制

9. 蓝图与应用结构

9.1 Flask 蓝图

9.2 蓝图高级用法

9.3 应用工厂模式

9.4 推荐的项目结构

9.5 包管理与依赖

10. 部署与维护

10.1 部署准备

10.2 WSGI 服务器

Gunicorn

uWSGI

10.3 Web 服务器配置

Nginx 配置

使用 HTTPS

10.4 Docker 部署

10.5 部署平台

Heroku

PythonAnywhere

AWS Elastic Beanstalk

10.6 性能监控与日志

10.7 自动化部署与 CI/CD

11. 总结