When building a Flask application, your server constantly receives HTTP requests from browsers, mobile apps, frontend applications, and other services.
Two of the most important HTTP methods you will work with are:
GET and POST.
A GET request is commonly used when a client wants to retrieve data.
A POST request is commonly used when a client wants to send data or create something new.
For example:
GET /products
might retrieve a list of products.
While:
POST /products
might create a new product.
Although GET and POST look simple, understanding how Flask receives query parameters, form data, JSON bodies, headers, validation errors, and responses is essential for building real websites and APIs.
This guide explains Flask GET and POST requests from the basics through practical examples.
What Is an HTTP Request?
Before understanding Flask GET and POST, you need to understand what a request actually is.
When a client communicates with a web server, it sends an HTTP request.
The client might be:
- A web browser
- A JavaScript frontend
- A Flutter mobile app
- An Android or iOS app
- Postman
- cURL
- Another backend server
A request contains information such as:
HTTP Method
URL
Headers
Query Parameters
Request Body
Cookies
For example:
POST /api/users
Content-Type: application/json
{
"name": "Alex",
"email": "alex@example.com"
}
The Flask application receives this request, processes it, and returns an HTTP response.
The basic flow is:
Client
↓
HTTP Request
↓
Flask Route
↓
Process Request Data
↓
HTTP Response
↓
Client
What Is a GET Request?
A GET request is primarily used to retrieve or read a resource from the server.
Examples include:
GET /products
GET /users
GET /users/10
GET /articles
GET /search?q=flask
GET requests should generally be designed as safe operations, meaning simply requesting the resource should not intentionally change server state.
For example:
GET /products
should retrieve products.
It should not create, update, or delete them.
Your First Flask GET Request
Create:
app.py
Add:
from flask import Flask
app = Flask(__name__)
@app.route("/hello", methods=["GET"])
def hello():
return "Hello from Flask!"
Run:
flask --app app run --debug
Visit:
http://127.0.0.1:5000/hello
Your browser sends approximately:
GET /hello
Flask matches the route:
@app.route("/hello", methods=["GET"])
and executes:
hello()
The response is:
Hello from Flask!
GET Is the Default Route Method
If you write:
@app.route("/products")
def products():
return "Products"
Flask allows GET for this route by default.
So you do not always need:
methods=["GET"]
However, explicitly specifying methods can sometimes make API routes easier to understand.
Returning JSON from a GET Request
Flask can return dictionaries as JSON responses.
Example:
@app.route("/api/user", methods=["GET"])
def get_user():
return {
"id": 1,
"name": "Alex",
"role": "Developer"
}
Request:
GET /api/user
Response:
{
"id": 1,
"name": "Alex",
"role": "Developer"
}
This is common when Flask acts as a backend API.
Returning a List of Data
Suppose your application contains:
products = [
{
"id": 1,
"name": "Laptop"
},
{
"id": 2,
"name": "Phone"
},
{
"id": 3,
"name": "Tablet"
}
]
Create:
@app.route("/api/products", methods=["GET"])
def get_products():
return products
Now:
GET /api/products
returns the product collection.
In a real application, the data would often come from a database.
Getting One Resource with GET
A dynamic route can identify a particular resource.
Example:
@app.route(
"/api/products/<int:product_id>",
methods=["GET"]
)
def get_product(product_id):
return {
"id": product_id,
"name": "Laptop"
}
Request:
GET /api/products/25
Flask extracts:
product_id = 25
and passes it to the route function.
Finding a Product by ID
A more realistic example:
products = [
{"id": 1, "name": "Laptop"},
{"id": 2, "name": "Phone"}
]
@app.route(
"/api/products/<int:product_id>",
methods=["GET"]
)
def get_product(product_id):
product = next(
(
item
for item in products
if item["id"] == product_id
),
None
)
if product is None:
return {
"error": "Product not found"
}, 404
return product
Request:
GET /api/products/2
returns:
{
"id": 2,
"name": "Phone"
}
But:
GET /api/products/100
returns a 404 response.
What Are Query Parameters?
GET requests frequently send optional values through the URL.
Example:
/products?category=phones
Here:
/products
is the route.
And:
category=phones
is a query parameter.
Query parameters begin after:
?
Multiple parameters are separated by:
&
Example:
/products?category=phones&page=2&sort=price
Reading Query Parameters in Flask
Flask provides the request object.
Import it:
from flask import request
Then:
@app.route("/products")
def products():
category = request.args.get("category")
return {
"category": category
}
Request:
GET /products?category=phones
produces:
{
"category": "phones"
}
What Is request.args?
request.args contains query-string parameters.
For:
/search?q=flask
you can use:
query = request.args.get("q")
For:
/products?page=3
you can use:
page = request.args.get("page")
Providing Default Query Values
Suppose the user visits:
/products
without a page parameter.
You can provide a default:
page = request.args.get(
"page",
default=1,
type=int
)
Now:
/products
uses:
page = 1
while:
/products?page=5
uses:
page = 5
Converting Query Parameter Types
URL query parameters arrive as text.
Flask can attempt type conversion:
page = request.args.get(
"page",
default=1,
type=int
)
This is useful for:
Pagination
Limits
Numeric filters
Example:
limit = request.args.get(
"limit",
default=20,
type=int
)
Multiple Query Parameters
Example URL:
/products?category=phones&page=2&sort=price
Flask:
@app.route("/products")
def products():
category = request.args.get("category")
page = request.args.get(
"page",
default=1,
type=int
)
sort = request.args.get(
"sort",
default="newest"
)
return {
"category": category,
"page": page,
"sort": sort
}
Query parameters are particularly useful for:
- Search
- Filtering
- Pagination
- Sorting
- Optional configuration
Search with GET
Search endpoints commonly use GET.
Example:
/search?q=flask
Flask:
@app.route("/search")
def search():
query = request.args.get(
"q",
default=""
)
return {
"search": query
}
This is better than creating URLs such as:
/search/flask
when the search term is naturally an optional query parameter.
Product Filtering Example
Imagine:
GET /products?category=laptop&max_price=1000
Flask:
@app.route("/products")
def products():
category = request.args.get(
"category"
)
max_price = request.args.get(
"max_price",
type=float
)
return {
"category": category,
"max_price": max_price
}
The backend can then use these values to construct appropriate filtering logic.
Pagination with GET
A common URL is:
/products?page=2&limit=20
Example:
@app.route("/products")
def products():
page = request.args.get(
"page",
default=1,
type=int
)
limit = request.args.get(
"limit",
default=20,
type=int
)
return {
"page": page,
"limit": limit
}
In production, validate acceptable ranges.
For example:
if page < 1:
page = 1
if limit < 1 or limit > 100:
limit = 20
This prevents unreasonable pagination requests.
What Is a POST Request?
A POST request is commonly used to send data to the server, often to create a new resource or submit an action.
Examples:
POST /users
POST /products
POST /orders
POST /login
POST /contact
A POST request can carry data in the request body.
For example:
{
"name": "Alex",
"email": "alex@example.com"
}
Unlike typical GET query parameters, POST data is commonly sent inside the request body.
Your First Flask POST Request
Example:
@app.route(
"/api/users",
methods=["POST"]
)
def create_user():
return {
"message": "User created"
}, 201
This route only accepts POST.
Request:
POST /api/users
Response:
{
"message": "User created"
}
with:
201 Created
GET vs POST
The basic difference is:
| Feature | GET | POST |
|---|---|---|
| Main purpose | Retrieve data | Submit/create data |
| Data commonly sent in | URL/query | Request body |
| Should change server state? | Generally no | Often yes |
| Bookmarkable | Usually yes | No |
| Common use | Search/list/detail | Create/form submission |
| Request body | Usually not used | Commonly used |
A useful mental model is:
GET
↓
Give me something
and:
POST
↓
Here is something to process
POST Form Data
Traditional HTML forms commonly submit data using POST.
Example:
<form method="POST" action="/login">
<input
type="email"
name="email"
>
<input
type="password"
name="password"
>
<button type="submit">
Login
</button>
</form>
When submitted, the browser sends form data to:
POST /login
Reading Form Data with request.form
Flask provides:
request.form
for form-encoded data.
Example:
from flask import request
@app.route(
"/login",
methods=["POST"]
)
def login():
email = request.form.get("email")
password = request.form.get("password")
return {
"email": email
}
Do not return passwords in real applications.
The example only demonstrates how form values are accessed.
Why Use .get()?
You might see:
request.form["email"]
But if email is missing, direct indexing can raise an error.
Using:
request.form.get("email")
allows you to handle missing data yourself.
For example:
email = request.form.get("email")
if not email:
return {
"error": "Email is required"
}, 400
Validating POST Form Data
Never assume incoming data is valid.
Example:
@app.route(
"/register",
methods=["POST"]
)
def register():
name = request.form.get("name")
email = request.form.get("email")
if not name:
return {
"error": "Name is required"
}, 400
if not email:
return {
"error": "Email is required"
}, 400
return {
"message": "Registration successful"
}, 201
Real applications should perform more complete validation.
POST JSON Data
Modern frontend and mobile applications commonly send JSON.
For example:
POST /api/users
Content-Type: application/json
Body:
{
"name": "Alex",
"email": "alex@example.com"
}
Flask can read JSON using:
request.get_json()
Reading JSON with Flask
Example:
@app.route(
"/api/users",
methods=["POST"]
)
def create_user():
data = request.get_json()
return {
"name": data["name"],
"email": data["email"]
}, 201
However, production code should not assume all fields exist.
Safer JSON Handling
A safer approach:
@app.route(
"/api/users",
methods=["POST"]
)
def create_user():
data = request.get_json(
silent=True
)
if not isinstance(data, dict):
return {
"error": "Valid JSON body is required"
}, 400
name = data.get("name")
email = data.get("email")
if not name:
return {
"error": "Name is required"
}, 400
if not email:
return {
"error": "Email is required"
}, 400
return {
"message": "User created",
"user": {
"name": name,
"email": email
}
}, 201
This handles missing or invalid data more cleanly.
Content-Type Matters
When sending JSON, clients should normally send:
Content-Type: application/json
When submitting a standard HTML form, you will commonly see:
application/x-www-form-urlencoded
File upload forms commonly use:
multipart/form-data
The content type helps the server understand how the request body is encoded.
Checking Content Type
You can inspect:
request.content_type
Example:
@app.route(
"/api/data",
methods=["POST"]
)
def data():
return {
"content_type": request.content_type
}
Flask also provides helpers for working with JSON requests.
request.is_json
You can check:
request.is_json
Example:
@app.route(
"/api/users",
methods=["POST"]
)
def create_user():
if not request.is_json:
return {
"error": "JSON body required"
}, 415
data = request.get_json()
return {
"data": data
}
415 Unsupported Media Type can be appropriate when the endpoint requires a content type the client did not provide.
HTML Form vs JSON POST
Traditional website:
Browser Form
↓
POST
↓
request.form
Modern API:
Flutter / React / Mobile App
↓
JSON POST
↓
request.get_json()
The correct method depends on the content type and application architecture.
GET and POST on the Same Route
Flask allows one route to support both methods.
Example:
@app.route(
"/login",
methods=["GET", "POST"]
)
def login():
if request.method == "POST":
email = request.form.get("email")
return f"Login submitted for {email}"
return "Show Login Form"
When the browser sends:
GET /login
the route can display the form.
When the browser sends:
POST /login
the same route processes the form.
Better GET + POST Form Example
from flask import (
Flask,
render_template,
request,
redirect,
url_for
)
app = Flask(__name__)
@app.route(
"/contact",
methods=["GET", "POST"]
)
def contact():
if request.method == "POST":
name = request.form.get("name")
message = request.form.get("message")
if not name or not message:
return render_template(
"contact.html",
error="All fields are required"
), 400
# Save or process the message.
return redirect(
url_for("contact_success")
)
return render_template(
"contact.html"
)
@app.route("/contact/success")
def contact_success():
return "Message submitted successfully"
This demonstrates a common server-rendered Flask workflow.
Post/Redirect/Get Pattern
After successfully processing a form POST, it is often better to redirect rather than immediately render the final page from the POST response.
Flow:
GET /contact
↓
Display Form
↓
POST /contact
↓
Process Form
↓
Redirect
↓
GET /contact/success
This is known as the:
Post/Redirect/Get (PRG) pattern.
It can help prevent duplicate submissions when the user refreshes the page after a successful POST.
Why GET Should Not Delete Data
Avoid:
GET /delete-user/10
because GET should generally be safe and retrieval-oriented.
A browser, crawler, prefetch system, or link scanner may follow GET links.
Using GET for destructive operations can create serious problems.
For API design, deleting a resource is typically represented as:
DELETE /users/10
For server-rendered HTML applications where forms do not natively submit DELETE, a POST endpoint can be used for a deletion action with appropriate CSRF protection.
Query Parameters vs POST Body
Consider filtering:
GET /products?category=phones
This is appropriate because the client is retrieving a filtered resource collection.
Now consider creating a product:
POST /products
Body:
{
"name": "Phone",
"price": 599
}
The product data belongs in the request body.
A useful rule is:
GET query parameters
→ Describe what data you want
POST body
→ Contains data you want the server to process
GET Request with Multiple Filters
Example:
GET /products?category=phones&min_price=200&max_price=1000&page=1
Flask:
@app.route("/products")
def products():
category = request.args.get(
"category"
)
min_price = request.args.get(
"min_price",
type=float
)
max_price = request.args.get(
"max_price",
type=float
)
page = request.args.get(
"page",
default=1,
type=int
)
return {
"category": category,
"min_price": min_price,
"max_price": max_price,
"page": page
}
This pattern works well for searchable and filterable collections.
POST Request with Nested JSON
JSON requests can contain nested data.
Example:
{
"customer": {
"name": "Alex",
"email": "alex@example.com"
},
"items": [
{
"product_id": 1,
"quantity": 2
},
{
"product_id": 4,
"quantity": 1
}
]
}
Flask:
data = request.get_json()
customer = data.get("customer")
items = data.get("items", [])
Then validate the structure before using it.
Never assume nested objects are present or correctly typed.
Reading Request Headers
HTTP requests can contain headers such as:
Authorization
Content-Type
Accept
User-Agent
Flask provides:
request.headers
Example:
@app.route("/api/profile")
def profile():
authorization = request.headers.get(
"Authorization"
)
return {
"authorization_received":
authorization is not None
}
Do not return actual authentication tokens in production responses or logs.
Authorization Header Example
An API client may send:
Authorization: Bearer TOKEN
Flask can read:
auth_header = request.headers.get(
"Authorization"
)
Actual token validation should be handled through a secure authentication layer rather than trusting the header value.
Reading Cookies
Flask requests can also contain cookies.
Example:
theme = request.cookies.get("theme")
Cookies may be used for preferences or session-related functionality depending on the application.
Authentication cookies require careful security configuration.
Reading Request Method
Flask provides:
request.method
Example:
@app.route(
"/example",
methods=["GET", "POST"]
)
def example():
return {
"method": request.method
}
GET request:
{
"method": "GET"
}
POST request:
{
"method": "POST"
}
Useful Flask Request Properties
Some useful request attributes include:
request.method
request.args
request.form
request.files
request.headers
request.cookies
request.is_json
request.content_type
And for JSON:
request.get_json()
Understanding these covers a large part of everyday request handling.
File Uploads with POST
Files are typically uploaded using POST with:
multipart/form-data
HTML:
<form
method="POST"
enctype="multipart/form-data"
>
<input
type="file"
name="image"
>
<button type="submit">
Upload
</button>
</form>
Flask:
@app.route(
"/upload",
methods=["POST"]
)
def upload():
file = request.files.get("image")
if file is None:
return {
"error": "Image is required"
}, 400
return {
"filename": file.filename
}
Actual file storage requires additional security considerations.
File Upload Security
Never blindly trust:
file.filename
or uploaded content.
Real applications should consider:
- Allowed file types
- File-size limits
- Safe filenames
- Unique server-side filenames
- Storage permissions
- Malware scanning where appropriate
- Image validation
- Access control
File uploads are user-controlled input.
Treat them accordingly.
Returning HTTP Status Codes
A Flask response can include a status code.
Example:
return {
"message": "User created"
}, 201
Common status codes include:
| Code | Meaning |
|---|---|
| 200 | OK |
| 201 | Created |
| 204 | No Content |
| 400 | Bad Request |
| 401 | Unauthorized |
| 403 | Forbidden |
| 404 | Not Found |
| 409 | Conflict |
| 415 | Unsupported Media Type |
| 422 | Unprocessable Content |
| 500 | Internal Server Error |
Choose status codes according to what actually happened.
200 vs 201
Use:
200 OK
for successful requests where a normal successful response is returned.
Use:
201 Created
when a new resource has been successfully created.
Example:
return user, 201
after:
POST /users
400 Bad Request
Use 400 when the request itself is malformed or fails basic request validation.
Example:
if not email:
return {
"error": "Email is required"
}, 400
Your API should return useful errors rather than crashing.
401 vs 403
These are often confused.
401 Unauthorized
Generally means valid authentication credentials are required or authentication failed.
403 Forbidden
Generally means the server understands who the user is but refuses the requested action due to permissions.
Conceptually:
401
→ Who are you?
403
→ I know who you are, but you cannot do this.
409 Conflict
A conflict can be useful when a request conflicts with current resource state.
For example:
if email_already_exists:
return {
"error": "Email already registered"
}, 409
This can be clearer than returning 500 or always returning 200.
Consistent API Responses
Avoid random response structures.
For example, do not alternate unnecessarily between:
{
"error": "Invalid email"
}
and:
{
"message": {
"problem": "Wrong email"
}
}
A consistent structure is easier for clients.
For example:
{
"success": false,
"error": {
"code": "INVALID_EMAIL",
"message": "Enter a valid email address."
}
}
Your exact format may differ, but consistency matters.
Complete GET API Example
from flask import Flask, request
app = Flask(__name__)
products = [
{
"id": 1,
"name": "Laptop",
"category": "electronics"
},
{
"id": 2,
"name": "Phone",
"category": "electronics"
},
{
"id": 3,
"name": "Desk",
"category": "furniture"
}
]
@app.route(
"/api/products",
methods=["GET"]
)
def get_products():
category = request.args.get(
"category"
)
if category:
filtered = [
product
for product in products
if product["category"] == category
]
return {
"products": filtered
}
return {
"products": products
}
Request:
GET /api/products
returns all products.
Request:
GET /api/products?category=electronics
returns matching products.
Complete POST API Example
@app.route(
"/api/products",
methods=["POST"]
)
def create_product():
if not request.is_json:
return {
"error": "JSON body required"
}, 415
data = request.get_json()
name = data.get("name")
category = data.get("category")
if not name:
return {
"error": "Product name is required"
}, 400
if not category:
return {
"error": "Category is required"
}, 400
product = {
"id": len(products) + 1,
"name": name,
"category": category
}
products.append(product)
return {
"message": "Product created",
"product": product
}, 201
Request:
POST /api/products
Body:
{
"name": "Keyboard",
"category": "electronics"
}
Response:
{
"message": "Product created",
"product": {
"id": 4,
"name": "Keyboard",
"category": "electronics"
}
}
Testing GET Requests in a Browser
GET requests are easy to test directly in a browser.
For example:
http://127.0.0.1:5000/api/products
or:
http://127.0.0.1:5000/api/products?category=electronics
Because entering a URL in a browser normally performs a GET request.
Testing with cURL
cURL is extremely useful for testing APIs from a terminal.
GET:
curl http://127.0.0.1:5000/api/products
GET with query parameter:
curl \
"http://127.0.0.1:5000/api/products?category=electronics"
Testing POST JSON with cURL
Example:
curl \
-X POST \
-H "Content-Type: application/json" \
-d '{"name":"Keyboard","category":"electronics"}' \
http://127.0.0.1:5000/api/products
This sends:
POST
with a JSON body.
Testing POST Form Data with cURL
Example:
curl \
-X POST \
-d "email=alex@example.com" \
-d "password=example-password" \
http://127.0.0.1:5000/login
This simulates traditional form-encoded data.
Use non-sensitive test credentials when experimenting.
Testing with Postman
Postman can also be used to test Flask APIs.
For GET:
Method: GET
URL: http://127.0.0.1:5000/api/products
For POST JSON:
Method: POST
URL: http://127.0.0.1:5000/api/products
Select a JSON body and send:
{
"name": "Keyboard",
"category": "electronics"
}
Also ensure the request uses the appropriate:
Content-Type: application/json
header.
Flask Request Flow
A useful mental model is:
Client
↓
GET / POST
↓
Flask Router
↓
request
↓
Validation
↓
Business Logic
↓
Database / Service
↓
Response
The route should not blindly pass request data directly into your database.
Validation and authorization belong between incoming data and sensitive operations.
Do Not Trust Client Data
Everything sent by the client can potentially be manipulated.
This includes:
Query parameters
Form values
JSON bodies
Headers
Cookies
File names
Uploaded files
URL parameters
Even if your frontend sends:
{
"price": 100,
"is_admin": false
}
a malicious client can change it.
The backend must decide which fields are accepted and which values are authoritative.
Never Trust Prices from the Client
Suppose checkout sends:
{
"product_id": 10,
"price": 1
}
Your server should not trust that price.
Instead:
Client sends product_id
↓
Server loads product
↓
Server gets authoritative price
↓
Server calculates total
Business-critical values should be validated or calculated server-side.
Validate Data Before Database Operations
Bad:
data = request.get_json()
User.create(
name=data["name"],
email=data["email"]
)
Better conceptually:
Receive Data
↓
Validate Structure
↓
Normalize Data
↓
Check Business Rules
↓
Check Authorization
↓
Write to Database
Validation prevents many bugs and security problems.
POST and CSRF Protection
Traditional browser forms that rely on cookie-based authentication may need protection against Cross-Site Request Forgery (CSRF).
For example:
POST /change-password
POST /delete-account
POST /update-email
should not accept forged cross-site submissions.
A common Flask approach is using a form/security extension that provides CSRF tokens.
The important principle is:
A POST request is not automatically secure simply because it uses POST.
Authentication, authorization, validation, and CSRF protection may still be necessary.
GET and Sensitive Information
Avoid placing sensitive values in GET URLs.
For example, do not design:
/login?password=mysecret
URLs may appear in:
- Browser history
- Server logs
- Analytics systems
- Referrer information
- Screenshots
- Monitoring tools
Passwords and other secrets should not be placed in query strings.
Also remember that POST does not encrypt data by itself.
Use HTTPS for secure transport.
POST Does Not Mean Encrypted
A common beginner misconception is:
POST = Secure
GET = Insecure
That is incorrect.
POST moves typical payload data into the request body, but HTTP itself can still be observed in transit.
Security in transit comes from:
HTTPS
not simply from choosing POST.
Production applications should use HTTPS.
GET Caching Considerations
GET responses can often be cached because GET is intended for retrieval.
POST responses are treated differently by caches and are not generally used as the standard mechanism for cacheable resource retrieval.
This is another reason to use HTTP methods according to their intended semantics.
GET Should Be Idempotent
Repeated GET requests should not intentionally create different server-side side effects.
For example:
GET /products/10
GET /products/10
GET /products/10
should simply retrieve the product repeatedly.
It should not:
Create orders
Charge payments
Delete products
Change passwords
GET is expected to be safe and idempotent in HTTP semantics.
Is POST Idempotent?
POST is generally not guaranteed to be idempotent.
For example:
POST /orders
sent twice might create two orders.
This matters when designing payment and order APIs.
Production systems may use mechanisms such as:
Idempotency keys
Unique request IDs
Database constraints
Duplicate detection
to prevent accidental duplicate operations.
Common GET Mistakes
Using GET to Modify Data
Avoid:
GET /delete/25
Sending Passwords in URLs
Avoid:
/login?password=123456
Ignoring Parameter Types
Validate:
page
limit
price
IDs
Allowing Unlimited Pagination
Avoid allowing:
?limit=1000000
without validation.
Trusting Filters Directly in Database Queries
Always use safe database APIs and validated inputs.
Common POST Mistakes
Not Validating JSON
Avoid assuming:
data["email"]
always exists.
Ignoring Content Type
Know whether your endpoint expects:
JSON
Form data
Multipart data
Returning 200 for Everything
Use meaningful status codes.
Trusting Client-Controlled Fields
Never trust values such as:
role
price
user_id
permissions
discount
payment_status
without server-side verification.
Storing Passwords Directly
Never store plain-text passwords.
Use established password hashing and authentication practices.
Missing Authorization
A valid POST request does not automatically mean the user has permission to perform the operation.
GET and POST Best Practices
Use these practical rules:
- Use GET for retrieving resources.
- Use POST for creation or action-oriented submissions where appropriate.
- Use query parameters for search, filters, sorting, and pagination.
- Use request bodies for submitted resource data.
- Validate every client-controlled value.
- Use meaningful HTTP status codes.
- Keep response structures consistent.
- Never send passwords through query parameters.
- Use HTTPS in production.
- Protect browser forms against CSRF where applicable.
- Check authentication and authorization.
- Limit pagination sizes.
- Validate JSON structure and content type.
- Never trust client-side prices or permissions.
- Handle missing data gracefully.
- Use Post/Redirect/Get for appropriate server-rendered forms.
- Consider duplicate POST handling for sensitive operations.
- Keep route functions focused.
Practical Registration Example
@app.route(
"/api/register",
methods=["POST"]
)
def register():
if not request.is_json:
return {
"error": "JSON body required"
}, 415
data = request.get_json()
name = data.get("name")
email = data.get("email")
password = data.get("password")
if not name:
return {
"error": "Name is required"
}, 400
if not email:
return {
"error": "Email is required"
}, 400
if not password:
return {
"error": "Password is required"
}, 400
# Validate email.
# Validate password policy.
# Check duplicate email.
# Hash password securely.
# Store user.
return {
"message": "Account created"
}, 201
This example intentionally leaves authentication implementation out because secure password storage deserves its own dedicated topic.
Practical Login Request Example
@app.route(
"/api/login",
methods=["POST"]
)
def login():
data = request.get_json(
silent=True
)
if not isinstance(data, dict):
return {
"error": "Valid JSON body required"
}, 400
email = data.get("email")
password = data.get("password")
if not email or not password:
return {
"error":
"Email and password are required"
}, 400
# Find user.
# Verify password securely.
# Create session/token.
return {
"message": "Login successful"
}
Never return the submitted password.
Practical Search API
@app.route(
"/api/search",
methods=["GET"]
)
def search():
query = request.args.get(
"q",
default=""
).strip()
page = request.args.get(
"page",
default=1,
type=int
)
if not query:
return {
"results": [],
"page": page
}
# Search database.
return {
"query": query,
"page": page,
"results": []
}
This demonstrates a natural GET use case.
GET and POST Quick Cheat Sheet
GET Route
@app.route(
"/products",
methods=["GET"]
)
def products():
return []
Query Parameter
search = request.args.get("search")
Integer Query Parameter
page = request.args.get(
"page",
default=1,
type=int
)
POST Route
@app.route(
"/products",
methods=["POST"]
)
def create_product():
...
Read JSON
data = request.get_json()
Check JSON
request.is_json
Read Form Data
email = request.form.get("email")
Read Header
token = request.headers.get(
"Authorization"
)
Read Cookie
theme = request.cookies.get("theme")
Read Uploaded File
file = request.files.get("image")
Read Method
request.method
Return 201
return {
"message": "Created"
}, 201
Return Validation Error
return {
"error": "Email is required"
}, 400
Frequently Asked Questions
What is a GET request in Flask?
A GET request is primarily used to retrieve resources from a Flask application.
Example:
GET /products
What is a POST request in Flask?
A POST request sends data to the server and is commonly used to create resources or submit actions.
Example:
POST /products
How do I read GET parameters in Flask?
Use:
request.args.get("parameter")
Example:
search = request.args.get("search")
How do I read POST form data?
Use:
request.form.get("field")
How do I read POST JSON?
Use:
request.get_json()
after ensuring the request contains the expected JSON content type.
Can one Flask route use both GET and POST?
Yes.
@app.route(
"/login",
methods=["GET", "POST"]
)
You can check:
request.method
to determine which method was used.
Should login use GET or POST?
A common server-rendered pattern is:
GET /login
to display the login form and:
POST /login
to submit credentials.
Passwords should never be placed in query parameters.
Is POST more secure than GET?
Not automatically.
POST places typical submitted data in the request body rather than the URL, but secure transport requires HTTPS.
Should GET change database data?
GET should generally be safe and should not intentionally modify application state.
What is request.args?
It contains query-string parameters.
Example:
/products?page=2
What is request.form?
It contains submitted form-encoded values.
What is request.get_json()?
It parses a JSON request body into Python data when used appropriately.
What status code should POST return?
When POST successfully creates a new resource:
201 Created
is commonly appropriate.
Other successful POST actions may appropriately use other 2xx status codes depending on the operation.
GET and POST Learning Roadmap
A good order is:
HTTP Request Basics
↓
GET Requests
↓
Query Parameters
↓
Filtering & Search
↓
Pagination
↓
POST Requests
↓
HTML Form Data
↓
JSON Request Bodies
↓
Content Types
↓
Validation
↓
Status Codes
↓
Redirects
↓
Authentication
↓
Authorization
↓
Security
↓
Production API Design
Focus first on understanding:
GET
→ Retrieve
and:
POST
→ Submit / Create / Process
Then learn how Flask exposes the different parts of a request through the request object.
Final Thoughts
GET and POST are two of the most important HTTP methods you will use in Flask.
A GET request commonly retrieves data:
GET /products
A POST request commonly submits or creates data:
POST /products
For GET query parameters, Flask provides:
request.args
For HTML form submissions:
request.form
For JSON requests:
request.get_json()
For headers:
request.headers
For file uploads:
request.files
A real Flask request flow often looks like:
Client
↓
GET / POST
↓
Flask Route
↓
Read Request Data
↓
Validate
↓
Authenticate / Authorize
↓
Business Logic
↓
Database
↓
HTTP Response
The most important rule is to treat every incoming value as client-controlled data.
Validate it, enforce permissions, return meaningful status codes, and use GET and POST according to their intended HTTP semantics.
Once you understand these concepts, you have the foundation needed for Flask forms, authentication, database CRUD operations, and REST API development.
