Flasgo

Why Flasgo

Flasgo keeps the core web-app path compact and readable while taking async execution, deployment posture, and security defaults seriously. It covers HTTP, typed request data, WebSockets, lifecycle, authentication, rate limits, testing, structured logs, protected metrics, OpenTelemetry, OpenAPI 3.2, and migrations without ballooning into a giant abstraction layer.

Execution model

HTTP, WebSockets, and lifespan

Flasgo is ASGI-native, with first-class request handling, secure WebSocket routes, application startup and shutdown, and post-response tasks.

Developer experience

Familiar routes with typed request data

Handlers and routes stay close to the Flask mental model, while Annotated binding, dataclass validation, and dependency injection keep larger APIs explicit.

Security posture

Defaults that assume deployment matters

Signed sessions, CSRF protection, host validation, SSRF guards, request limits, cache controls, and hardened headers are part of the documented baseline.

What ships with Flasgo

01

Routing and typed request handling

Define handlers directly, bind validated data and reusable dependencies, and keep application flow easy to trace.

02

WebSockets and lifecycle

Use origin-checked WebSocket routes, lifespan-managed resources, process state, and best-effort background tasks.

03

Security-sensitive defaults

Session signing, CSRF, allowed hosts, and header defaults are treated as part of the core framework story.

04

Testing and operations

The official client, CLI checks, structured logs, protected Prometheus metrics, OpenTelemetry traces, OpenAPI 3.2 output, and optional migrations cover the path to production.

What’s new

Latest release

Flasgo 0.11.0

Flasgo 0.11.0 bounds route matching time, fixes form, upload, dependency, and test-client edge cases, routes applications mounted under an ASGI root path, and updates the JWT, database, and OpenTelemetry extras.

• Routes with several converters in one segment match in linear time per route.
• JWT helpers reject PEM, SSH, DER, and JWK-shaped secrets with ValueError.
• The db extra pins Alembic 1.20, which requires SQLAlchemy 2.0.

Upgrade notes →Installation status →Full changelog →

Flasgo 0.10.0 hardened host and CSRF origin validation, request parameter binding, response semantics, and sessions, and added async template rendering. See the 0.10.0 changes. Flasgo 0.9.0 added nested blueprints, dependency cleanup and overrides, enforced response contracts, streaming/SSE/NDJSON, policy comparisons, and shared Redis/Valkey quotas and sessions. See the 0.9.0 additions.

Start reading

BuildHTTP applications

Use routes, requests, responses, middleware, sessions, forms, templates, uploads, and static files.

ValidateRequest data and dependencies

Bind typed bodies, query values, headers, cookies, forms, and reusable providers.

RealtimeWebSockets and lifecycle

Manage secure connections, startup resources, process state, and background work.

SecuritySecurity and authentication

Apply secure settings, permissions, rate limits, SSRF protection, and OWASP-aware application controls.

VerifyTesting

Exercise HTTP, cookies, streams, lifespan, and WebSockets with the official test client.

OperateObservability

Correlate structured logs, protect Prometheus metrics, and export OpenTelemetry traces.