Responses

# 1. String → 200 text/html
return "Hello"

# 2. (body, status)
return "Not Found", 404

# 3. (body, headers)
return "OK", {"X-Custom": "value"}

# 4. (body, status, headers)
return "Created", 201, {"Location": "/items/1"}

# 5. Response object
from flask import Response
return Response("OK", status=200, mimetype="text/plain")

# 6. dict or list → auto-JSON (Flask 2.2+)
return {"id": 1, "name": "Alice"}      # 200 application/json
return [{"id": 1}, {"id": 2}]          # 200 application/json

# 7. jsonify
from flask import jsonify
return jsonify({"id": 1})

from flask import make_response, render_template

@app.route("/cookie-demo")
def cookie_demo():
    resp = make_response(render_template("index.html"))
    resp.set_cookie("theme", "dark")
    resp.headers["X-Frame-Options"] = "DENY"
    resp.status_code = 200
    return resp

resp = make_response("body", 201)
resp = make_response(("body", 201, {"X-Foo": "bar"}))

from flask import redirect, url_for

@app.route("/old")
def old():
    return redirect(url_for("new"))           # 302 Found

@app.route("/moved")
def moved():
    return redirect("/new-path", code=301)    # 301 Moved Permanently

@app.route("/see-other")
def see_other():
    return redirect(url_for("index"), 303)    # 303 See Other (POST→GET)

from flask import abort

abort(404)                   # raises HTTPException immediately
abort(403)
abort(400, "Invalid input")  # description (shown in default error page)
abort(Response("custom body", 418))   # abort with a custom Response

from flask import jsonify

@app.route("/api/user/<int:id>")
def get_user(id):
    user = {"id": id, "name": "Alice"}
    return jsonify(user), 200

# Lists
return jsonify([{"id": 1}, {"id": 2}])

# Nested
return jsonify({"users": [{"id": 1}], "total": 1})

from flask.json.provider import DefaultJSONProvider
import decimal

class CustomProvider(DefaultJSONProvider):
    def default(self, o):
        if isinstance(o, decimal.Decimal):
            return str(o)
        return super().default(o)

app.json_provider_class = CustomProvider
app.json = CustomProvider(app)

from flask import stream_with_context, Response

def generate():
    for i in range(100):
        yield f"data: {i}\n\n"

@app.route("/stream")
def stream():
    return Response(stream_with_context(generate()), mimetype="text/event-stream")

def read_file_chunks(path, chunk_size=8192):
    with open(path, "rb") as f:
        while chunk := f.read(chunk_size):
            yield chunk

@app.route("/download")
def download():
    return Response(read_file_chunks("/path/to/file"), mimetype="application/octet-stream")

from flask import send_file, send_from_directory

# Send a file object or path
send_file("path/to/report.pdf")
send_file("report.pdf", mimetype="application/pdf")
send_file("report.pdf", as_attachment=True)                # Content-Disposition: attachment
send_file("report.pdf", download_name="my-report.pdf")     # rename for download
send_file(io.BytesIO(data), mimetype="image/png")          # in-memory file

# Safe directory serving (prevents path traversal)
send_from_directory("uploads", filename)
send_from_directory(app.config["UPLOAD_FOLDER"], filename, as_attachment=True)

resp = make_response("OK")
resp.set_cookie(
    "session_id",
    value="abc123",
    max_age=3600,            # seconds until expiry (alternative to expires)
    expires=None,            # datetime or timestamp
    path="/",
    domain=None,             # defaults to current domain
    secure=True,             # HTTPS only
    httponly=True,           # no JS access
    samesite="Lax",          # "Strict", "Lax", or "None"
)
resp.delete_cookie("old_cookie")

@app.after_request
def security_headers(resp):
    resp.headers["X-Content-Type-Options"] = "nosniff"
    resp.headers["X-Frame-Options"] = "SAMEORIGIN"
    resp.headers["Content-Security-Policy"] = "default-src 'self'"
    resp.headers["Strict-Transport-Security"] = "max-age=31536000"
    return resp

from flask import Response

resp = make_response(render_template("page.html"))
resp.cache_control.max_age = 300        # 5 minutes
resp.cache_control.public = True
resp.cache_control.no_cache = True      # revalidate every time
resp.cache_control.no_store = True      # sensitive data — never cache
resp.headers["ETag"] = "abc123"
resp.headers["Last-Modified"] = "Wed, 21 Oct 2023 07:28:00 GMT"

@app.after_request
def cors(resp):
    resp.headers["Access-Control-Allow-Origin"] = "*"
    resp.headers["Access-Control-Allow-Headers"] = "Content-Type,Authorization"
    resp.headers["Access-Control-Allow-Methods"] = "GET,POST,PUT,DELETE,OPTIONS"
    return resp

@app.route("/api/<path:path>", methods=["OPTIONS"])
def options_handler(path):
    return "", 204

pip install flask-cors

from flask_cors import CORS
CORS(app)
CORS(app, resources={r"/api/*": {"origins": "https://example.com"}})