Glossary

A file listing files Git should not track, such as virtual environments and secrets.

The request succeeded and the response carries the result.

The request succeeded and a new resource was created.

The request succeeded but there is nothing to send back.

The resource now lives at a new URL for good, and clients should use the new one from now on.

A temporary redirect to another URL; Flask redirect() sends this by default.

The cached copy is still valid, so the server sends no body.

The server cannot understand the request because it is malformed or has invalid data.

The client is not authenticated, meaning it has not proved who it is.

The server knows who you are but you are not allowed to do this.

The server has no resource at that URL.

The URL exists but does not accept the method used, such as POST on a GET-only route.

The request clashes with the current state of the resource, such as creating a duplicate.

The client has sent too many requests in a given time and is being rate limited.

The server hit an unexpected problem such as an unhandled exception in the code.

A proxy such as nginx got an invalid answer from the application server behind it.

The server cannot handle the request right now, for example because it is overloaded or down.

== compares after converting types, while === compares value and type with no conversion, so === is safer.

A short-lived token used to call the API.

A response header that names the origins permitted to read the response.

Designing pages so people with disabilities, such as blind users with screen readers, can use them.

Four promises of reliable transactions: Atomicity, Consistency, Isolation and Durability.

A Vuex function that may do asynchronous work such as API calls and then commits mutations.

A method that attaches a function to run when a given event happens on an element.

A function like COUNT, SUM, AVG, MIN or MAX that turns many rows into one value.

Updating part of a page with data fetched in the background, without reloading the whole page.

The alt attribute on an image that describes it in words for screen readers or when the image fails to load.

Application Programming Interface, a defined way for one program to ask another to do something or give data.

Planning an API's URLs, methods, inputs, outputs and errors so it is clear, consistent and easy to use.

Keeping old and new forms of an API available, for example /api/v1/, so existing clients keep working when it changes.

Flask's way of making app-level objects, like the current app and database, available while handling a request or command.

A function that builds and returns a configured Flask app, making testing and setup easier.

A set of attributes like aria-label and role that give assistive technology extra meaning about elements.

A short function written (x) => x * 2 that does not have its own this.

A statement that fails the test if its condition is false.

A table that holds two foreign keys to connect rows in a many-to-many relationship.

A function marked async that always returns a promise and may use await inside.

Code that starts a task and carries on, handling the result later when it finishes.

Extra information inside a start tag, written as name="value", like href or class.

Checking who a user is, for example with a password.

Deciding what an already identified user is allowed to do.

Jinja2 turns characters like < into safe text by default so user input cannot run as HTML or script.

A keyword that pauses an async function until a promise settles and then gives its value.

A JavaScript library for making HTTP requests that returns promises, often used with Vue.

A balanced tree structure that databases commonly use for indexes, allowing fast search and ordered reading.

A task that runs outside the web request so the user does not wait for it.

A token sent in the header Authorization: Bearer <token>, where whoever holds it is trusted.

An element like <div> or <p> that starts on a new line and takes the full width.

A Flask feature that groups related routes and templates into a reusable part of an app.

A popular CSS and JavaScript library with ready-made classes and components for building responsive pages quickly.

A 12-column layout system using container, row and col-* classes.

The slowest part of a system, which limits the speed of the whole.

The idea that each element is a box made of content, padding, border and margin.

A separate line of development in Git, letting you try changes without touching the main code.

In Celery, the service that carries task messages from the app to workers.

A program that sends HTTP requests and displays HTML, CSS and JavaScript results as pages.

Files the browser keeps locally so it need not download them again.

A request found in the cache, which is fast.

Removing or updating cached data when the original data changes so users do not see stale values.

A request not found in the cache, so the data must be fetched or computed.

An HTTP header that tells browsers and proxies how long and whether to cache a response.

Keeping a copy of a result so it can be reused instead of being worked out again.

The list of functions currently running; the one on top runs first.

A function passed to another function to be called later.

The address you give a service so it can send you a webhook request.

Any column or set of columns that could uniquely identify a row; one of them is chosen as the primary key.

How many instances of one entity can relate to instances of another: one-to-one, one-to-many or many-to-many.

The rules a browser uses to pick a winning style from many sources, using origin, specificity and order.

A Content Delivery Network, a group of servers around the world that deliver files such as Bootstrap or Vue quickly from a nearby location.

A Python library that runs background tasks on separate worker processes.

A scheduler that sends tasks to the queue at set times, such as every night.

A Python function marked with @celery.task that can be run in the background by a worker.

The rule that turns characters into bytes and back, which is why a wrong one produces garbled text.

A cleaner syntax for making objects with a constructor and methods, built on prototypes.

A selector written with a dot, like .card, that matches every element with that class.

The program (usually a browser) that sends a request and shows the response to the user.

A design where clients ask for things and servers answer, so work is split between the two.

Building the HTML in the browser with JavaScript from data, instead of on the server.

A function that remembers the variables from the place it was created, even after that place has finished running.

Making the changes of a transaction permanent in the database.

A saved snapshot of your tracked files with a message describing the change.

In Vuex, commit triggers a mutation and dispatch triggers an action.

A reusable piece of interface with its own template, data and logic.

A value worked out from other data that is cached and recomputed only when what it uses changes.

A rule the database enforces on data, such as NOT NULL, UNIQUE, primary key or foreign key.

A light, isolated running package of an app and its dependencies that shares the host's operating system.

A header that names the format of the body, such as text/html or application/json.

A small piece of data a server asks the browser to store and send back with later requests.

A cookie is stored and sent by the browser by itself, while a token is usually stored by your code and added to the header on purpose.

Cross-Origin Resource Sharing, a way for a server to tell the browser that certain other origins may read its responses.

An automatic OPTIONS request the browser sends before certain cross-origin requests to ask if the real one is allowed.

A lifecycle hook that runs after data is set up but before the component is shown on the page.

A schedule format using minute, hour, day and month fields, also available in Celery beat.

Create, Read, Update, Delete, the four basic actions on data, mapping to POST, GET, PUT or PATCH, and DELETE.

Cross-Site Request Forgery, an attack that tricks a logged-in user's browser into sending an unwanted request to a site.

A secret random value placed in a form and checked by the server to prove the request came from the real page.

Cascading Style Sheets, the language that controls how HTML looks, such as colours, fonts and layout.

A CSS layout system that places items in rows and columns of a two-dimensional grid.

Comma-Separated Values, a plain text format where each line is a row and commas separate the columns.

An event a child sends up to its parent using this plus the emit method.

A value in the data option of Vue that is made reactive.

The kind of value a column holds, such as INTEGER, TEXT or REAL.

The basic kinds of value: number, string, boolean, null, undefined, symbol, bigint and object.

An organised store of data that can be searched and changed efficiently.

The way to declare a table column on a model class, giving its type and options.

The base class in Flask-SQLAlchemy that you extend to make a model class mapped to a table.

A function that lets a model reach related rows as Python attributes without writing the join by hand.

The object that collects changes to models and sends them to the database on commit().

Database Management System, software that stores, manages and retrieves data in a database.

A Flask setting that reloads the server on code change and shows a detailed error page; it must never be on in production.

Finding and fixing mistakes in code.

A Python feature written with @ above a function that wraps it to add behaviour, such as @app.route.

A method on a Celery task that sends it to the queue to run later.

A method that removes a resource.

Putting an app on a server so real users can use it.

Turning received text or bytes, such as JSON, back into an object.

A Vue 2 lifecycle hook that runs after a component is removed, a good place to clean up timers.

Pulling values out of arrays or objects into variables, like const {a, b} = obj.

A special attribute starting with v- that tells Vue to do something to an element.

The Domain Name System, which turns domain names into IP addresses.

A tool that packs an app and everything it needs into a container so it runs the same everywhere.

The first line <!DOCTYPE html> that tells the browser to treat the page as modern HTML5.

The Document Object Model, the browser's tree of objects that represents a page and that JavaScript can read and change.

A human-friendly name like example.com that stands in for a numeric IP address.

A route with a variable part like /user/<int:id> whose value is passed to the view function.

The official standard that JavaScript follows; ES6 (2015) added let, const, arrow functions and classes.

A Vue method a child uses to trigger a named event, optionally with data, that the parent listens to.

One URL, together with its allowed methods, where an API accepts requests.

A thing we want to store data about, such as a student or a course.

A named value outside the code, such as a secret key, that a program can read when it runs.

A drawing of a database design showing entities, their attributes and the relationships between them.

A function marked with @app.errorhandler that makes a custom response for an error code.

Turning special characters into harmless text so they are not treated as code.

A response header holding an identifier of a version of a resource, used to check if cached copies are still current.

Something that happens in the page, such as a click or key press, that code can react to.

An event first fires on the clicked element and then moves up through its parents.

Putting one listener on a parent to handle events from many children, using bubbling.

The mechanism that takes finished tasks from queues and runs them when the call stack is empty, letting single-threaded JavaScript do async work.

A suffix like .prevent or .stop on v-on that changes how an event is handled.

The browser object that opens an SSE connection and receives its events.

A browser function that sends an HTTP request and returns a promise of the response.

A pytest function marked @pytest.fixture that prepares things like a test client or database for tests.

A one-time message stored in the session by flash() and shown on the next page.

A small Python web framework for building web apps and APIs.

Flask's session object, which stores data in a signed cookie that the user can read but not change without the secret key.

A Flask extension that adds caching to views and functions, with Redis as one possible backend.

A Flask extension that adds CORS headers to responses.

A Flask extension for making and checking JWTs.

A Flask extension that uses Alembic to track and apply changes to the database schema.

A Flask extension that helps build REST APIs using classes, one method per HTTP verb.

A Flask extension that adds login, registration, roles and password hashing.

A Flask extension that connects SQLAlchemy to a Flask app with simple setup.

A CSS layout system, turned on with display: flex, that arranges items in a row or column and shares space between them.

A column that holds the primary key of a row in another table, linking the two tables.

The <form> element that groups input fields and sends their values to the server with a chosen method and action.

Searching the words inside large text, ranking results by relevance, instead of simple pattern matching.

A method that asks for a resource and should not change anything on the server.

A Vuex function that works out a value from the state, like a computed property for the store.

A tool that records versions of your files so you can see history, undo changes and work with others.

A website that hosts Git repositories online for sharing and teamwork.

A URL that lets a program post a message into a Google Chat space using an HTTP POST.

A SQL clause that bundles rows with the same value so aggregate functions can work on each bundle.

A production Python WSGI server that runs several worker processes to handle requests.

A function that turns any input into a fixed-size value that cannot practically be reversed.

Vue Router ways to make URLs; hash mode uses # in the URL, while history mode makes normal URLs and needs server support.

Hashing is one-way and cannot be undone, while encryption can be reversed with a key.

A SQL clause that filters groups after GROUP BY, whereas WHERE filters rows before grouping.

A function that takes another function as input or returns one, such as map and filter.

JavaScript's moving of declarations to the top of their scope before running; var and function declarations are hoisted, while let and const stay unusable until declared.

HyperText Markup Language, the language that describes the structure and content of a web page using tags.

The current version of HTML, which added semantic tags, audio, video, canvas and new form inputs.

HyperText Transfer Protocol, the set of rules a client and server follow to exchange requests and responses on the web.

A name: value line in a request or response that carries extra information such as content type or cookies.

The verb in a request (GET, POST, PUT, PATCH, DELETE) that says what action the client wants.

A cookie flag that stops JavaScript from reading the cookie, which reduces damage from XSS.

HTTP sent over an encrypted TLS connection so others cannot read or change the data on the way.

A selector written with a hash, like #header, that matches the one element with that id.

A unique value sent with a request so a repeated try is recognised and does not do the action twice.

Describes an operation that gives the same end result whether you do it once or many times; GET, PUT and DELETE are idempotent, POST is not.

A database that keeps data in RAM, which is fast but may lose data if not saved to disk.

An extra data structure on one or more columns that lets the database find rows quickly without scanning the whole table.

A browser database for storing larger amounts of structured data.

When a child element takes some property values, such as color and font-family, from its parent.

An element like <span> or <a> that stays inside the line of text and takes only the width it needs.

The <input> tag, which makes a field such as text, password, checkbox or file, depending on its type.

Checking that data from users has the right type, size and form before using it.

A test that checks that several parts, such as a route and the database, work together.

A list that maps each word to the documents containing it, the core idea behind full-text search.

The programming language that runs in browsers (and in Node.js) to make pages interactive.

A function applied to a value with a pipe, like {{ name|upper }}.

The templating engine used by Flask that lets HTML files contain variables, loops and conditions.

A SQL operation that combines rows from two tables using a related column.

JavaScript Object Notation, a light text format of keys and values used to send data between programs.

Turns a JSON string into a JavaScript value.

Turns a JavaScript value into a JSON string.

A Flask function that turns Python data into a JSON response with the right content type.

JSON Web Token, a signed token with header, payload and signature that carries claims such as the user ID.

The part of a JWT made with a secret or private key that proves the token was not changed.

A unique :key given to items in v-for so Vue can track and reuse elements properly.

A database that saves each value under a unique key and fetches it by that key.

The time it takes to get a response to a request.

A join that keeps every row from the left table and fills with NULL where the right table has no match.

A function Vue calls at set stages of a component's life, such as created, mounted, updated and destroyed.

A server that spreads incoming requests over several copies of an app.

Sending many requests to an app on purpose to see how it behaves under heavy use.

A name for your own computer, pointing to the IP address 127.0.0.1.

Browser storage that keeps string data with no expiry until it is cleared, for one site.

A label for how serious a message is: DEBUG, INFO, WARNING, ERROR or CRITICAL.

Writing messages about what a program is doing to a file or screen so problems can be traced later.

A decorator that blocks a route unless the user is logged in.

A local fake mail server that catches emails during development so none go out for real.

A relationship where rows on both sides can match many on the other, stored using a third link table.

Array methods that transform every item, keep matching items, or combine all items into one value.

A Flask-RESTful decorator that shapes the returned object into a fixed set of output fields.

A CSS @media rule that applies styles only when conditions such as screen width are met.

Combining the changes from one Git branch into another.

A clash when two branches changed the same lines and Git needs a person to choose.

A middleman, such as Redis or RabbitMQ, that holds task messages from the app until a worker takes them.

Functions in the methods option of Vue that can be called from templates and events.

A higher-priority queue for promise callbacks, which runs before the next ordinary task.

A saved step that changes a database schema, such as adding a column, which can be applied or undone.

Removing spaces and shortening names in code to make files smaller without changing behaviour.

A JavaScript file that shares code using export and loads it using import.

A part of the Vuex store with its own state, getters, mutations and actions, used to split a big store.

A lifecycle hook that runs after the component has been put on the page and its element can be used.

Showing data in a Vue template with double curly braces like {{ message }}.

A Vuex function that is the only way to change state, and it must be synchronous.

Model-View-Controller, a way of splitting an app into data (model), what the user sees (view) and the logic joining them (controller).

A slot with a name so a parent can fill different places in a component.

A Vue Router function, like beforeEach, that runs before a route change and can allow, redirect or cancel it.

A fast web server often placed in front of an app to serve static files and pass other requests along.

Organising tables to cut repeated data and avoid update mistakes by splitting them in a careful way.

The Node Package Manager, a tool and registry for installing JavaScript packages.

A special marker meaning a value is missing or unknown; it is not zero or an empty string.

A relationship where one row on one side matches many rows on the other, such as one teacher and many classes.

A standard format, usually YAML, for describing an API's endpoints, inputs and outputs so tools can read it.

A method that asks the server which methods or cross-origin actions are allowed; browsers use it for CORS preflight.

The combination of scheme, host and port of a URL; if any differs, the origin is different.

Object-Relational Mapper, a tool that lets you use Python classes and objects instead of writing SQL for tables and rows.

A file in a JavaScript project that lists its name, scripts and dependencies.

Returning a large list in small pages so responses stay small and fast.

A query where values are passed separately from the SQL text, so inputs cannot change the query's meaning.

Storing a one-way scrambled form of a password instead of the password itself.

A method that changes only some fields of a resource.

Measuring how fast an app is, for example response time and throughput, before and after changes.

A task that is run again and again on a schedule, set up with Celery beat.

The client asking the server again and again at intervals whether there is new data.

A number that tells a computer which program should receive incoming data; HTTP uses 80 and HTTPS uses 443 by default.

A method that sends data to the server, usually to create something or trigger an action.

A pattern where a POST handler redirects to a GET page so refreshing does not resubmit the form.

A column or set of columns whose values uniquely identify each row and are never empty.

Giving a user or program only the permissions it really needs.

The live setting where real users use the app, as opposed to development or testing.

A web app that can be installed, work offline and send notifications, using a manifest and a service worker.

An object standing for a value that will arrive later, which ends as fulfilled or rejected.

Waits for all promises to succeed and gives their results as an array, or fails as soon as one fails.

Data a parent passes down to a child component, which the child should not change.

Passing data through many layers of components just to reach a deep one, which a store avoids.

The object another object borrows properties and methods from, forming the prototype chain.

Push sends your commits to a remote repository; pull brings others' commits to you.

A method that replaces a whole resource with the data sent; repeating it gives the same result.

A Python testing tool that runs functions named test_* and checks them with plain assert statements.

An object, such as User.query.filter_by(...), used to fetch rows as model objects.

The part of a URL after ? that carries key=value pairs separated by &.

A bug where the result depends on the unpredictable order of steps that run at the same time.

Capping how many requests a client may make in a period to protect the server.

Role-Based Access Control, where permissions are given to roles such as admin or user and users get roles.

Vue's ability to notice changes in data and update the page automatically.

A response that tells the browser to go to a different URL.

A Flask function that tells the browser to go to another URL.

A very fast in-memory data store used for caching, queues and counters.

A longer-lived token used to get a new access token without logging in again.

A database that keeps data in tables of rows and columns connected by keys.

A link between two entities, such as a student enrolling in a course.

A Flask function that fills a Jinja2 template with data and returns the finished HTML.

Collecting data and turning it into a document such as a PDF or CSV, usually in a background job.

A Flask-RESTful helper for declaring and checking the inputs a request must have.

A message from a client to a server that has a method, a URL, headers and sometimes a body.

The data a client sends along with a request, such as form fields or JSON.

The Flask object that holds details of the current request such as form, args, json and method.

A file listing the Python packages and versions a project needs.

A thing an API exposes, such as a user or a book, identified by a URL.

A Flask-RESTful class with methods like get and post, attached to a URL by api.add_resource.

The message a server sends back, with a status code, headers and usually a body.

A method that reads a fetch response body and parses it as JSON, returning a promise.

Building pages that adjust their layout to fit phones, tablets and desktops.

Representational State Transfer, a style for designing web APIs around resources, URLs and standard HTTP methods.

An API that follows REST ideas, such as stateless requests and resources identified by URLs.

A place where Celery stores task results and status so they can be read later.

A server that receives client requests and forwards them to another server behind it.

Undoing the changes of a transaction that has not been committed.

A rule linking a URL path to a Python function, made in Flask with @app.route.

Variable parts of a Vue route such as /user/:id, read with the current route object.

A Vue Router component that makes a link which changes the route without a page reload.

A Vue Router component that shows the component matching the current route.

A method that is only meant to read data and not change the server, such as GET and HEAD.

Random data added to a password before hashing so equal passwords get different hashes.

A browser rule that stops a page from reading responses from a different origin.

A cookie setting that limits when cookies are sent on cross-site requests, helping stop CSRF.

A task set to run on its own at fixed times without anyone starting it.

The design of a database: its tables, columns, types and relationships.

The part of the code where a variable can be used.

Software that reads page content aloud for people who cannot see the screen.

A private value Flask uses to sign cookies and tokens; it must be kept secret.

The part of a CSS rule that picks which elements to style, such as p, .box or #main.

Using tags like <header>, <nav>, <main> and <footer> that describe the meaning of content, not just how it looks.

Turning an object in memory into text or bytes, such as JSON, so it can be sent or stored.

A program or computer that waits for requests from clients and sends back responses.

A way for a server to push a stream of text messages to the browser over one long-lived HTTP connection, one way only.

Building the HTML on the server and sending the finished page to the browser.

A script that runs in the background of the browser, between the page and network, enabling offline use and caching.

Data the server remembers about one user across several requests, tied to that user by a session ID.

Browser storage that keeps string data only until that tab is closed.

A function that runs a callback again and again at a fixed interval until cleared.

A function that runs a callback once after a delay.

A .vue file that holds a component's template, script and style together.

A web app that loads one page and then updates its content with JavaScript instead of loading new pages.

A placeholder in a component's template where the parent can insert its own content.

Simple Mail Transfer Protocol, the protocol used to send email between servers.

The scoring that decides which CSS rule wins when several match; ID beats class, and class beats element.

Structured Query Language, the language for creating, reading, changing and deleting data in relational databases.

An attack where a user types SQL into an input so it changes your query; stopped by parameterised queries or an ORM.

A Python library with an ORM and a toolkit for working with SQL databases.

A lightweight relational database that stores everything in a single file and needs no separate server.

The list of function calls shown when an error occurs, helping you find where it came from.

Old cached data that no longer matches the real data.

The single object in the Vuex store that holds the shared data.

Describes a server that keeps no memory of earlier requests, so each request must carry everything needed to handle it.

A file such as an image, CSS or JavaScript file that is sent as it is, kept in Flask's static folder.

A three-digit number in a response that tells whether the request worked and why not if it failed.

The Vuex object that holds state, getters, mutations and actions.

A query written inside another query.

A set of tools built around OpenAPI, including a page for trying out API calls in the browser.

Code that runs one step at a time, with each step waiting for the previous one.

A grid in a database made of rows and columns that holds one kind of data.

A waiting line of callbacks, such as timer callbacks, that run once the stack is empty.

A list of jobs waiting for worker programs to pick them up and run them.

An HTML file with placeholders that get filled with real data before it is sent to the user.

HTML with Vue syntax that describes what a component shows based on its data.

Making a base template with {% block %} areas that child templates fill in with {% extends %}.

A string in backticks that can include values with a dollar sign and braces and span many lines.

The time between entering a scope and the line where a let or const is declared, when using it throws an error.

A Flask tool, app.test_client(), that sends fake requests to the app without running a server.

The content type a server uses to send server-sent events.

Promise methods that handle success, handle failure, and run code in either case.

A cookie set by a site other than the one in the address bar, often blocked by browsers.

A keyword whose value depends on how a function is called; arrow functions use the this of the code around them.

How many requests a system handles in a given time.

Logging in once to get a token, then sending that token with each request instead of a password or session cookie.

The time after which a token is no longer accepted, limiting harm if it is stolen.

A group of database steps that are treated as one unit and either all succeed or all are undone.

Values that act as true or false in a condition; falsy ones are false, 0, "", null, undefined and NaN.

The way to handle errors from awaited promises, with catch receiving a rejection.

Time To Live, how long a cached item stays valid before it expires.

A standard that gives a unique number, called a code point, to every character in almost every writing system.

A small automatic test that checks one piece of code, such as one function.

A lifecycle hook that runs after changed data has caused the page to re-render.

The full address of a resource on the web, made of scheme, host, optional port, path, query string and fragment.

A Flask function that builds a URL from a view function name so links do not break when routes change.

A way to store Unicode characters as bytes, using one to four bytes per character and one byte for plain English letters.

A directive that ties an attribute to data, often written as :, like :src="url".

A directive used right after v-if that shows when the condition is false.

A directive that repeats an element for each item of a list.

A directive that adds or removes an element from the page depending on a condition.

A directive that keeps a form input and a data property in sync both ways.

A directive that listens to events, often written as @, like @click="save".

A directive that hides or shows an element using CSS display, keeping it in the page.

The Python function that runs for a route and returns the response.

The tag <meta name="viewport" ...> that makes mobile browsers use the device width, needed for responsive pages.

A light copy of the page structure in JavaScript that Vue compares with its earlier copy to change only what differs in the real DOM.

An isolated Python setup with its own installed packages for one project.

A command-line tool for creating and building Vue projects with a ready setup.

The object made with new Vue({...}) that links data, methods and a page element.

Vue's official library for showing different components for different URLs in a single-page app.

A JavaScript framework for building user interfaces from reactive data and components.

Vue's official store library that keeps shared state for all components in one place.

A function in watch that runs when a chosen data property changes, good for side effects such as fetching.

A huge collection of pages and resources linked together and reached through browsers over the internet using URLs and HTTP.

A JSON file that gives an app's name, icons and colours so it can be installed on a device.

Browser storage for key-value data, made of localStorage and sessionStorage.

A way for one service to call a URL you provide when something happens, so you get told instead of asking again and again.

A tool that bundles many JavaScript, CSS and other files into a few files for the browser.

A connection that stays open and lets client and server send messages to each other both ways at any time.

A Celery process that takes tasks from the broker and runs them.

Web Server Gateway Interface, the Python standard for how a web server talks to a Python web app.

Cross-Site Scripting, an attack where an attacker's script runs in other users' browsers, stopped by escaping output.