# Feature catalog — pallets/werkzeug

> Canonical page: https://codevetter.com/unpack/werkzeug/feature-catalog

# Feature catalog — pallets/werkzeug

Scanned commit 594452f6a4fe4de38a544962fbf04bfc9d37fbc2 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The developer-facing features cover HTTP request interpretation, response construction, routing, file transfer, security helpers, and testing. Middleware adds application composition and operational diagnostics. Development tooling includes a server, reloader, and browser debugger. The inspected example demonstrates user-facing URL creation, redirects, and click statistics.
- Request exposes query parameters and cookies as immutable multidicts, form fields through lazy parsing, and JSON parsing with force, silent, and cache controls. — [src/werkzeug/sansio/request.py#L158-L182](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/sansio/request.py#L158-L182) [src/werkzeug/sansio/request.py#L263-L280](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/sansio/request.py#L263-L280) [src/werkzeug/wrappers/request.py#L633-L642](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L633-L642) [src/werkzeug/wrappers/request.py#L837-L867](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L837-L867)
- Response supports streaming WSGI output and suppresses bodies for HEAD, informational responses, 204, and 304; cookie setters expose Secure, HttpOnly, SameSite, and Partitioned attributes. — [src/werkzeug/wrappers/response.py#L548-L592](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/response.py#L548-L592) [src/werkzeug/sansio/response.py#L159-L170](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/sansio/response.py#L159-L170)
- Routing supports string, any, path, integer, float, and UUID converters, canonical redirects, method restrictions, and distinct WebSocket matching. — [src/werkzeug/routing/map.py#L93-L101](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/routing/map.py#L93-L101) [src/werkzeug/routing/map.py#L658-L690](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/routing/map.py#L658-L690) [tests/test_routing.py#L1777-L1787](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_routing.py#L1777-L1787)
- send_file provides attachment naming, MIME inference, cache metadata, conditional responses, ranges, and X-Sendfile; SharedDataMiddleware maps URL prefixes to filesystem or package resources. — [src/werkzeug/utils.py#L448-L490](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L448-L490) [src/werkzeug/utils.py#L492-L549](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L492-L549) [src/werkzeug/middleware/shared_data.py#L31-L62](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/shared_data.py#L31-L62)
- Security helpers generate scrypt or PBKDF2 password hashes, compare stored hashes with hmac.compare_digest, and validate untrusted URL path components with safe_join. — [src/werkzeug/security.py#L27-L76](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/security.py#L27-L76) [src/werkzeug/security.py#L113-L156](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/security.py#L113-L156)
- Middleware can mount WSGI applications by path, rewrite trusted forwarded metadata, proxy HTTP requests, lint protocol behavior, and profile requests with optional output files. — [src/werkzeug/middleware/dispatcher.py#L44-L81](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/dispatcher.py#L44-L81) [src/werkzeug/middleware/proxy_fix.py#L43-L67](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/proxy_fix.py#L43-L67) [src/werkzeug/middleware/http_proxy.py#L103-L161](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/http_proxy.py#L103-L161) [src/werkzeug/middleware/profiler.py#L38-L55](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/profiler.py#L38-L55)
- Development serving selects single-process, threaded, or forked servers, optionally adds debugging/static middleware, and supports automatic reloading; Client simulates WSGI requests and follows redirects without a server. — [src/werkzeug/serving.py#L930-L952](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/serving.py#L930-L952) [src/werkzeug/serving.py#L1079-L1131](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/serving.py#L1079-L1131) [src/werkzeug/test.py#L1070-L1089](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/test.py#L1070-L1089) [src/werkzeug/middleware/lint.py#L5-L8](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/middleware/lint.py#L5-L8)
- Shortly offers POST / to create a short URL, /<short_id> to increment clicks and redirect, and /<short_id>+ to display target and click-count details; missing identifiers produce its custom 404 page. — [examples/shortly/shortly.py#L49-L91](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L49-L91) [examples/shortly/shortly.py#L107-L115](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L107-L115)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)