OAuth2 password flow in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this FastAPI OAuth2 password flow token endpoint?

Consider this FastAPI endpoint using OAuth2 password flow. What will the response JSON contain after a successful login?

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import OAuth2PasswordRequestForm
from fastapi.responses import JSONResponse
app = FastAPI()

@app.post('/token')
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    if form_data.username == 'user' and form_data.password == 'pass':
        return {'access_token': 'fake-token', 'token_type': 'bearer'}
    return JSONResponse(status_code=400, content={'error': 'Invalid credentials'})

A {"access_token": "user", "token_type": "bearer"}

B {"error": "Invalid credentials"}

C HTTP 404 Not Found

D {"access_token": "fake-token", "token_type": "bearer"}

💡 Hint

Check what the function returns when username and password match.

The endpoint returns a JSON with access_token and token_type when credentials are correct.

❓ state_output

intermediate

What is the value of the token_type field in the OAuth2 password flow response?

Given a successful OAuth2 password flow token response in FastAPI, what is the value of the 'token_type' field?

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import OAuth2PasswordRequestForm
app = FastAPI()

@app.post('/token')
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    return {'access_token': 'token123', 'token_type': 'bearer'}

A Bearer

B bearer

C token

D access

💡 Hint

OAuth2 standard uses a lowercase token type.

The OAuth2 standard specifies the token type as 'bearer' in lowercase.

📝 Syntax

advanced

Which option correctly defines the OAuth2PasswordRequestForm dependency in FastAPI?

Select the correct way to use OAuth2PasswordRequestForm in a FastAPI endpoint for password flow authentication.

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import OAuth2PasswordRequestForm
app = FastAPI()

@app.post('/token')
async def login(???):
    pass

A form_data: OAuth2PasswordRequestForm = Depends()

B form_data = OAuth2PasswordRequestForm()

C form_data: OAuth2PasswordRequestForm()

D form_data: OAuth2PasswordRequestForm

💡 Hint

Use Depends() to declare dependencies in FastAPI function parameters.

FastAPI requires dependencies to be declared with Depends(). Option A is correct.

🔧 Debug

advanced

What error will this FastAPI OAuth2 password flow code raise?

Identify the error raised by this code snippet when the /token endpoint is called with valid credentials.

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import OAuth2PasswordRequestForm
app = FastAPI()

@app.post('/token')
async def login(form_data: OAuth2PasswordRequestForm):
    if form_data.username == 'user' and form_data.password == 'pass':
        return {'access_token': 'token', 'token_type': 'bearer'}
    return {'error': 'Invalid credentials'}

A RuntimeError: Dependency injection failed

B No error, returns token JSON

C TypeError: login() missing 1 required positional argument: 'form_data'

D ValidationError from OAuth2PasswordRequestForm

💡 Hint

Check how dependencies must be declared with Depends() in FastAPI.

The function parameter lacks Depends(), so FastAPI cannot inject the dependency, causing a TypeError.

🧠 Conceptual

expert

Which statement best describes the OAuth2 password flow in FastAPI?

Choose the most accurate description of how OAuth2 password flow works in FastAPI applications.

A The client sends username and password to the token endpoint, which returns an access token if valid.

B The client receives an authorization code first, then exchanges it for an access token.

C The client uses refresh tokens only to get new access tokens without user credentials.

D The client authenticates using API keys passed in the URL query parameters.

💡 Hint

Password flow involves direct username and password exchange for tokens.

OAuth2 password flow involves sending user credentials directly to the token endpoint to get an access token.