Reading request.formrequest.form manually works, but it gets repetitive and error-prone.

Flask-WTF is a popular extension that provides:

• form classes
• built-in validators
• CSRF protection
• easy rendering helpers

Under the hood it builds on WTForms.

Install

pip install Flask-WTF

pip install Flask-WTF

Configure a secret key

CSRF protection requires a SECRET_KEYSECRET_KEY.

from flask import Flask
 
app = Flask(__name__)
app.config["SECRET_KEY"] = "change-this-in-real-apps"

from flask import Flask
 
app = Flask(__name__)
app.config["SECRET_KEY"] = "change-this-in-real-apps"

In production, set SECRET_KEYSECRET_KEY from an environment variable.

Key idea

Instead of reading arbitrary strings from request.formrequest.form, you work with a Form object:

• fields are defined in Python
• validators run consistently
• errors are structured and easy to display

This dramatically improves maintainability.

🧪 Try It Yourself

Exercise 1 – Create a Flask App

Exercise 2 – Dynamic Route

Exercise 3 – Return JSON