Blood Donor Management App with Flask and MongoDB: Safe Demo

Updated 21 October 2026. This Flask and MongoDB project is a local classroom demo, not a production donor registry. Use fictional records only. Names, contact details, and donor information are personal and may be sensitive; do not enter real donor data in this sample or publish it as an open directory.

Before building: protect donor information

A real service would need a privacy and security design before it collects or shares information: collect only what is needed, explain the purpose, limit who can view or change records, set a retention and deletion process, and review applicable requirements. This tutorial does not implement those production controls.

The old setup allowed MongoDB access from 0.0.0.0/0. MongoDB documents that this gives access from anywhere and can expose a deployment to unauthorized access. For a local exercise, allow only your current development IP; for a deployed app, restrict access to the trusted application host or private network.

Set up a restricted Atlas demo database

Create a separate test project and database user for this demo. Give the user only the permissions it needs on the demo database. Store the MongoDB connection URI in an environment variable or deployment secret store, not in app.py, a notebook, a Docker image, or a public repository.

Project files

blood-donor-demo/
  app.py
  templates/
    index.html
  requirements.txt
  Dockerfile

Install Flask and PyMongo in your virtual environment. Add an HTML form with name, blood_group, and city fields that sends a POST request to /donors, plus a search form that sends keyword to /search. Keep the inputs fictional.

Core Flask and MongoDB pattern

import os
import re
from flask import Flask, request
from pymongo import MongoClient

app = Flask(__name__)
mongo_uri = os.environ.get("MONGODB_URI")
if not mongo_uri:
    raise RuntimeError("Set MONGODB_URI in your environment.")

client = MongoClient(mongo_uri, serverSelectionTimeoutMS=5000)
db = client["donor_demo"]
donors = db["donors"]
VALID_GROUPS = {"A+", "A-", "B+", "B-", "AB+", "AB-", "O+", "O-"}

@app.post("/donors")
def add_demo_donor():
    name = (request.form.get("name") or "").strip()
    group = (request.form.get("blood_group") or "").strip()
    city = (request.form.get("city") or "").strip()
    if not name or len(name) > 80 or not city or len(city) > 80:
        return {"error": "Invalid demo input"}, 400
    if group not in VALID_GROUPS:
        return {"error": "Invalid blood group"}, 400
    donors.insert_one({"name": name, "blood_group": group, "city": city})
    return {"message": "Demo record saved"}, 201

@app.post("/search")
def search_demo_donors():
    term = (request.form.get("keyword") or "").strip()[:50]
    if not term:
        return {"error": "Enter a search term"}, 400
    pattern = re.escape(term)
    results = list(donors.find(
        {"$or": [
            {"name": {"$regex": pattern, "$options": "i"}},
            {"blood_group": {"$regex": pattern, "$options": "i"}},
            {"city": {"$regex": pattern, "$options": "i"}}
        ]},
        {"_id": 0, "name": 1, "blood_group": 1, "city": 1}
    ).limit(20))
    return {"results": results}, 200

Set MONGODB_URI in your local shell before running the app. Do not paste a real connection string into source code. This example validates basic fields, limits search length, escapes the search term, and caps returned results. It still has no login, authorization, or CSRF protection, so run it only on your development machine with synthetic data.

Docker and cloud deployment

Docker packages the app but does not make it secure. If you containerize the demo, inject MONGODB_URI at runtime and keep secret files out of the image and source control. Do not publish a port to the public internet. Before hosting any real service, add authentication, role-based access, CSRF protection, HTTPS, monitoring, backups, and a reviewed retention plan.

Flask's built-in development server is intended for development, not production. Use a supported production WSGI server only after adding the missing application and data protections. A cloud host such as Azure also needs its own access controls and secret configuration.

Test with synthetic records

Try records such as Sample Donor A, O+, Sample City, then search by group or city. Test empty fields, invalid blood groups, long values, and searches containing punctuation. Delete the test data when the exercise is finished.

Official security references

MongoDB Atlas IP access lists and the risks of 0.0.0.0/0

MongoDB Atlas authorization and least privilege

Flask deployment guidance

OWASP guidance on protecting data