Flask comes with a built-in server for development. What is the main reason you should avoid using it in a production environment?
Think about what a production server needs compared to a development server.
The built-in Flask server is simple and meant for testing and development only. It cannot handle many users or heavy traffic well, which is why a production-ready server like Gunicorn or uWSGI is used instead.
Consider a Flask app running with debug=True in production. What is the likely outcome?
Debug mode shows extra information when errors happen. Is that safe for everyone to see?
Debug mode shows detailed error pages and an interactive debugger that can execute code. This can expose sensitive information and allow attackers to run code on your server, so it must be off in production.
Given this Flask app code snippet, what will be the output when accessed in production mode?
from flask import Flask app = Flask(__name__) @app.route('/') def home(): if app.debug: return 'Debug Mode On' else: return 'Production Mode' if __name__ == '__main__': app.run(debug=False)
Check the value of app.debug when debug=False is passed to app.run().
When debug=False, app.debug is False, so the else branch runs returning 'Production Mode'.
Which option contains a syntax error that would prevent this Flask production setup from running?
from flask import Flask app = Flask(__name__) if __name__ == '__main__': app.run(host='0.0.0.0', port=8000, debug=False)
Look carefully at how the host IP address is written in each option.
Option A is missing quotes around the IP address, causing a syntax error. The host must be a string.
Consider this Flask app snippet:
from flask import Flask
app = Flask(__name__)
@app.route('/')
def index():
return undefined_variable
if __name__ == '__main__':
app.run(debug=False)Why does this app crash with a 500 error in production but shows a detailed error page in development?
Think about how Flask handles errors differently in debug mode versus production.
In development (debug mode), Flask shows detailed error pages with tracebacks. In production, it hides details and returns a generic 500 error to avoid exposing sensitive info.