Frameworks

Web basics first, taught once: HTTP, auth, security and ORMs. Then Flask, Django and FastAPI, each building the same small Notes API, so you can compare them side by side.

It ends with the tools job posts ask for: Docker, CI/CD and cloud basics on AWS. Framework code runs on your machine with one command.

How to use this roadmap

Topics are in teaching order. “Builds on” links show what to know first, even from other tracks.
New? Start at the top. Know some already? Jump to a level, or skip any topic you can already explain.
Short on time? Tick “Asked often only” to see what interviews ask most.
Your progress is saved in this browser.

Best after: Python, SQL. Do Python foundations and core, plus SQL foundations, first. You will build APIs that store data.

25 topics in 4 levels, about 10 h of reading. With practice, plan 2 to 3 times that. 13 of 25 topics have lessons so far.

40 practice problems from this track’s lessons, in one list.

Foundations

Know this level already? Check what you know: 11 questions, about 6 minutes. Topics you get right are marked Known.

1. HTTP methods and status codesAsked oftenNot started
GET, POST and friends, and what 200, 404 and 500 mean.
- My app said “Saved” when nothing was saved
Start
15 min read, about 1 h 15 min with practiceBuilds on: Client–server, HTTP and HTTPS (System Design)
2. WSGI vs ASGINot started
How Python web apps talk to the web server, the classic way and the async way.
- 200 open chats froze my Flask server
Start
15 min read, about 1 h 10 min with practiceBuilds on: HTTP methods and status codes
3. The request lifecycleNot started
Everything that happens from a request arriving to the response leaving.
- Our error pages lost their security headers
Start
15 min read, about 1 h 10 min with practiceBuilds on: HTTP methods and status codes
4. REST designAsked oftenNot started
Name URLs and choose methods and status codes the way clients expect.
- The same note showed up twice as I scrolled
Start
20 min read, about 1 h 20 min with practiceBuilds on: HTTP methods and status codes
5. Sessions, JWT and OAuth2Asked oftenNot started
Three ways to remember who is logged in, and their trade-offs.
- Users are logged out at random behind the load balancer
Start
25 min read, about 1 h 25 min with practiceBuilds on: HTTP methods and status codes
6. CORS and CSRFNot started
Two browser security rules that block requests, and why they exist.
- The browser blocked my front end from calling my own API
Start
15 min read, about 1 h 10 min with practiceBuilds on: HTTP methods and status codes
7. Top OWASP risks: injection, XSS, broken authenticationNot started
The most common web attacks, and how frameworks help you block them.
- Someone typed a quote into our search box and read other users’ notes
Start
20 min read, about 1 h 10 min with practice

Core

1. ORMs and migrationsNot started
Work with database rows as Python objects, and change tables safely over time.
- The second deploy crashed: table notes already exists
Start
20 min read, about 1 h 10 min with practiceBuilds on: Joins: inner, left, right, full, self and cross (SQL) · Classes: inheritance, MRO, super() and dunder methods (Python)
2. Flask: routing, contexts, blueprints, app factory, config, Jinja2, SQLAlchemy, testingNot started
Build a small API in Flask, the minimal framework.
- My Flask tests pass one at a time, and fail together
Start
40 min read, about 1 h 10 min with practiceBuilds on: The request lifecycle · Decorators, with arguments and functools.wraps (Python)
3. Django: apps, MTV, views, the ORM, migrations, admin, forms, middleware, authAsked oftenNot started
Build the same API in Django, the batteries-included framework.
- The note form showed one mistake at a time, and saved spaces as a title
Start
45 min read, about 1 h 10 min with practiceBuilds on: The request lifecycle · ORMs and migrations
4. Django ORM performance: N+1, select_related, prefetch_relatedAsked oftenNot started
Fix pages that run hundreds of queries, the classic Django slowdown.
- The order list page is slow
Start
20 min read, about 1 h 20 min with practiceBuilds on: Django: apps, MTV, views, the ORM, migrations, admin, forms, middleware, auth
5. Django REST Framework: serializers, viewsets, permissions, throttling, paginationNot started
Build JSON APIs on Django with serializers and viewsets.
- A user made someone else the owner of a note by adding one field to the JSON
Start
30 min read, about 1 h 10 min with practiceBuilds on: Django: apps, MTV, views, the ORM, migrations, admin, forms, middleware, auth
6. FastAPI: parameters, Pydantic v2, response models, dependency injection, routersAsked oftenNot started
Build the same API in FastAPI, with automatic checks on input and free docs.
- Every request opened two database sessions, and closed none
Start
35 min read, about 1 h 10 min with practiceBuilds on: The request lifecycle · Type hints (Python) · Decorators, with arguments and functools.wraps (Python)

Advanced

1. FastAPI async def vs def: the event loop and the threadpoolAsked oftenComing soon
When async helps in FastAPI, and the mistake that freezes every request.
20 min readBuilds on: FastAPI: parameters, Pydantic v2, response models, dependency injection, routers · asyncio in depth: event loop, tasks, gather, cancellation, timeouts (Python)
2. Background jobs: Celery and RQComing soon
Run slow work outside the request, like emails and reports.
25 min readBuilds on: Queues and pub/sub (System Design)
3. Caching in web appsComing soon
Cache pages, queries and API results, and clear them at the right time.
20 min readBuilds on: Caching: cache-aside, write-through, write-back, eviction, TTL (System Design)
4. Testing web appsAsked oftenComing soon
Test endpoints with a test client and a throwaway database.
25 min readBuilds on: pytest basics (Python)
5. Docker for Python apps: images, containers and ComposeAsked oftenComing soon
Package your app and its setup into an image that runs the same everywhere.
25 min read
6. Deployment: Gunicorn or Uvicorn, a reverse proxy, Docker, environment configComing soon
Run your app for real: an app server, a reverse proxy and settings per environment.
25 min readBuilds on: Docker for Python apps: images, containers and Compose
7. CI/CD: run tests and deploy on every push with GitHub ActionsComing soon
Run the tests on every push, and deploy automatically when they pass.
20 min readBuilds on: Testing web apps · Docker for Python apps: images, containers and Compose
8. Cloud basics on AWS: EC2, S3, RDS, Lambda and IAMComing soon
The handful of AWS services most Python jobs use, and what each is for.
30 min readBuilds on: Deployment: Gunicorn or Uvicorn, a reverse proxy, Docker, environment config
9. FastAPI: lifespan, OAuth2 with JWT, SQLAlchemy 2.x async, WebSocketsComing soon
Startup and shutdown hooks, token login, async database access and live connections.
30 min readBuilds on: FastAPI async def vs def: the event loop and the threadpool
10. Django: signals, caching, security settings, async viewsComing soon
Signals, caching, security settings and async views.
25 min readBuilds on: Django: apps, MTV, views, the ORM, migrations, admin, forms, middleware, auth

Interview-ready

1. Flask vs Django vs FastAPI decision guideComing soon
Which framework for which job, in one table.
10 min read
2. The Notes API in all three, side by sideComing soon
One small API in all three frameworks, compared line by line.
20 min read