Flask 3.1

Apply the Jinja 3.1 and Python 3 prompts first. These rules cover Flask 3.1 configuration, proxy and request trust, sessions, CSRF, CORS, authentication, rendering, file handling, errors, and production deployment.

Configuration and application setup

• Load production configuration from a trusted source and fail startup when SECRET_KEY or another required control is missing.
• Generate a high-entropy SECRET_KEY, keep it outside source, and use Flask 3.1 SECRET_KEY_FALLBACKS only for a bounded rotation window before removing expired keys; verify rotation support separately in extensions that use the key.
• On Flask 3.1.0, which predates the 3.1.1 fix, a non-empty SECRET_KEY_FALLBACKS makes Flask sign new sessions with the last fallback key instead of SECRET_KEY, so leave the fallback list empty on that release.
• Keep debug mode and the interactive debugger disabled in every reachable production environment.
• Register authentication, CSRF, error handling, and security headers centrally through an application factory.
• Keep development defaults, example credentials, test routes, and permissive extension settings out of production configuration.

Requests, hosts, and proxies

• Set TRUSTED_HOSTS to a nonempty list of exact production hostnames; its default is None, which allows any domain, and a leading dot trusts that domain plus all subdomains.
• Reject untrusted hosts at the front proxy when callbacks require trusted host data; SERVER_NAME does not filter hosts, and before_request and after_request still run when TRUSTED_HOSTS rejects a