What is Flasgo?

Flasgo is a Python 3.14+ ASGI web framework that pairs Flask-style route authoring with security defaults commonly expected from larger production frameworks. It keeps the application object small and treats async HTTP, WebSockets, startup, and shutdown as the normal execution model.

Design goals

Goal	What it means in practice
Flask-like ergonomics	Decorator routes, compact handlers, request-local helpers, and quick iteration
ASGI-native runtime	Async request handling under servers such as uvicorn
Secure defaults	Host validation, CSRF checks, signed sessions, response headers, SSRF guards, and request limits
Type-friendly API	Public primitives and helpers intended to work cleanly with current Python tooling

What ships with it

Flasgo covers the common web application path without requiring a large application scaffold:

• Routing with converters such as <name>, <int:name>, <float:name>, and <path:name>
• Typed request binding and validation for JSON, query strings, headers, cookies, forms, and uploaded files
• Cached sync or async dependency injection through Depends()
• Response coercion for strings, bytes, dictionaries, lists, tuples, and explicit Response objects
• Sandboxed Jinja templating and static file serving
• Signed cookie sessions and request-local request, session, and current_user accessors
• Pluggable authentication backends, strict optional JWT helpers, and authorization metadata
• Disabled-by-default, exact-origin CORS with application and per-route policies
• Route-level rate limiting and security-failure throttling
• Origin-checked WebSockets with bounded messages and connection-level throttling
• Lifespan-managed resources, process state, and post-response background tasks
• Structured request-correlated logs, optional protected Prometheus metrics, and optional OpenTelemetry traces
• A lifecycle-aware HTTP and WebSocket test client
• OpenAPI 3.2 generation with JSON Schema 2020-12 and optional protected Swagger UI endpoints
• CLI commands for running, route inspection, OpenAPI output, deployment checks, and optional Alembic migrations

Flasgo 0.9.0 additions

Flasgo 0.9.0 adds HTTP blueprints and URL generation, explicit dependency lifetimes and test overrides, response contracts, bounded streams/SSE/NDJSON, deployment policy snapshots, and shared Redis/Valkey quotas and sessions. See the 0.9.0 feature overview and its linked guides. Flasgo leaves ORM selection, durable background jobs, event replay, and the outbound HTTP client to the application.

When it fits

Use Flasgo for APIs, service backends, and small to medium server-rendered apps where the team wants the route-level simplicity of Flask but still wants a default deployment posture that includes host checks, CSRF, secure cookies, and hardened response headers.

Related docs:

• Core Architecture
• Key Components
• Security Architecture
• Getting Started

Sources:

• README.md
• pyproject.toml