The Request Object

Every HTTP request has:

• method (GET/POST/…)
• URL path
• query string
• headers
• optional body (form data / JSON)

In Flask, you access request data through flask.request.

diagram where each piece of a request ends up on the request object mermaid

  flowchart LR
  R["incoming request"] --> Q["?page=2 in the URL"]
  R --> F["form body, urlencoded"]
  R --> U["form body, multipart"]
  R --> J["body with Content-Type: application/json"]
  R --> H["headers and cookies"]
  Q --> Q2["request.args"]
  F --> F2["request.form"]
  U --> U2["request.files"]
  J --> J2["request.get_json()"]
  H --> H2["request.headers / request.cookies"]
  J2 -.->|"does NOT appear in"| F2

Four different attributes, and picking the wrong one is the usual reason a value comes back as None. The query string is args, a submitted form is form, uploads are files, and a JSON body is json -- a JSON POST does NOT populate request.form, which is the mistake that sends people looking for a bug in their client.

Importing request

python

from flask import request

request is a context-local proxy that points to the current request.

Common request attributes

• request.method — HTTP method
• request.args — query parameters (MultiDict)
• request.form — form fields from POST body (MultiDict)
• request.files — uploaded files
• request.json / request.get_json() — JSON payload
• request.headers — request headers
• request.cookies — cookies

Quick demo route

python

from flask import Flask, request
 
app = Flask(__name__)
 
 
@app.route("/inspect", methods=["GET", "POST"])
def inspect():
    return {
        "method": request.method,
        "args": request.args,
        "form": request.form,
        "content_type": request.content_type,
    }

Note: request.args and request.form are MultiDict objects; Flask can serialize them in JSON responses, but you may want to cast them to dict for clarity.

Important security idea

Treat everything from request as untrusted:

• validate type
• validate allowed values
• sanitize output

Later, Flask-WTF + validators automate a lot of this.