Bearer token handling in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a valid bearer token is provided?

Consider this FastAPI endpoint that requires a bearer token for access. What will be the response if the token is valid?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

app = FastAPI()
security = HTTPBearer()

@app.get("/secure-data")
async def secure_data(credentials: HTTPAuthorizationCredentials = Depends(security)):
    if credentials.scheme != "Bearer" or credentials.credentials != "validtoken123":
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
    return {"message": "Access granted"}

A {"message": "Access granted"}

B {"detail": "Invalid token"}

C HTTPException with status code 403

D Empty response with status code 200

💡 Hint

Check the condition that validates the token and what the function returns if the token matches.

If the token matches "validtoken123" and the scheme is "Bearer", the endpoint returns a JSON message confirming access. Otherwise, it raises a 401 error.

📝 Syntax

intermediate

Which option correctly extracts the bearer token from the Authorization header?

Given a FastAPI dependency to extract a bearer token, which code snippet correctly retrieves the token string?

FastAPI

from fastapi import Depends
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

security = HTTPBearer()

def get_token(credentials: HTTPAuthorizationCredentials = Depends(security)):
    # Extract token here
    pass

A return credentials.credentials

B return credentials.token

C return credentials.auth

D return credentials.scheme

💡 Hint

Look at the attributes of HTTPAuthorizationCredentials to find the token string.

The token string is stored in the credentials attribute. Other attributes like scheme hold the type (e.g., 'Bearer').

🔧 Debug

advanced

Why does this FastAPI endpoint always raise 401 Unauthorized even with a valid token?

Review the code below. The endpoint should accept a bearer token 'secrettoken' but always returns 401 Unauthorized. What is the cause?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

app = FastAPI()
security = HTTPBearer()

@app.get("/data")
async def get_data(credentials: HTTPAuthorizationCredentials = Depends(security)):
    if credentials.scheme != "Bearer" or credentials.credentials != "secrettoken":
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Unauthorized")
    return {"data": "secret info"}

A HTTPBearer() is not imported correctly

B The scheme comparison is case-sensitive; 'bearer' should be 'Bearer'

C The token string 'secrettoken' is incorrect

D Depends() is missing in the function parameter

💡 Hint

Check the exact string used to compare the scheme in the Authorization header.

The scheme in the Authorization header is 'Bearer' with uppercase B. Comparing with lowercase 'bearer' causes the condition to fail always.

❓ state_output

advanced

What is the response when no Authorization header is sent?

Given this FastAPI endpoint using HTTPBearer, what response does the client receive if the Authorization header is missing?

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import HTTPBearer

app = FastAPI()
security = HTTPBearer()

@app.get("/info")
async def info(credentials = Depends(security)):
    return {"token": credentials.credentials}

A HTTP 403 Forbidden error

B HTTP 200 OK with token value None

C Empty JSON response {}

D HTTP 401 Unauthorized error

💡 Hint

Consider how HTTPBearer behaves when no Authorization header is provided.

HTTPBearer automatically returns a 401 Unauthorized error if the Authorization header is missing.

🧠 Conceptual

expert

Which statement best describes the role of HTTPBearer in FastAPI?

Choose the most accurate description of what HTTPBearer does in FastAPI applications.

A It automatically authenticates the user and sets user info in the request context

B It extracts and validates the bearer token from the Authorization header and raises 401 if missing or invalid

C It only extracts the bearer token from the Authorization header but does not validate it

D It encrypts the bearer token before sending it to the server

💡 Hint

Think about whether HTTPBearer checks token correctness or just extracts it.

HTTPBearer only extracts the token and checks the header format. It does not validate token content or authenticate the user. Validation must be done separately.