Protected routes in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing a protected route without credentials?

Consider a FastAPI app with a route protected by HTTP Basic authentication. What happens if a client tries to access the route without providing any credentials?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBasic, HTTPBasicCredentials

app = FastAPI()
security = HTTPBasic()

@app.get('/protected')
def protected_route(credentials: HTTPBasicCredentials = Depends(security)):
    if credentials.username == 'user' and credentials.password == 'pass':
        return {'message': 'Access granted'}
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail='Invalid credentials')

A The server responds with status 403 Forbidden and message 'Invalid credentials'

B The server responds with status 401 Unauthorized and a detail message 'Not authenticated'

C The server responds with status 200 OK and message 'Access granted'

D The server crashes with a runtime error due to missing credentials

💡 Hint

Think about what FastAPI's HTTPBasic security does when no credentials are sent.

When no credentials are provided, FastAPI's HTTPBasic dependency automatically returns a 401 Unauthorized response with a 'Not authenticated' detail. The route code is not executed.

❓ state_output

intermediate

What is the response when correct credentials are provided?

Given the same FastAPI app as before, what is the response when the client sends username 'user' and password 'pass'?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBasic, HTTPBasicCredentials

app = FastAPI()
security = HTTPBasic()

@app.get('/protected')
def protected_route(credentials: HTTPBasicCredentials = Depends(security)):
    if credentials.username == 'user' and credentials.password == 'pass':
        return {'message': 'Access granted'}
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail='Invalid credentials')

A {'detail': 'Invalid credentials'} with status 401 Unauthorized

B Empty response with status 204 No Content

C {'detail': 'Not authenticated'} with status 401 Unauthorized

D {'message': 'Access granted'} with status 200 OK

💡 Hint

Check the condition inside the route function for valid credentials.

If the username and password match, the route returns a JSON message 'Access granted' with status 200 OK.

📝 Syntax

advanced

Which option correctly protects a route using OAuth2PasswordBearer?

Which code snippet correctly uses OAuth2PasswordBearer to protect a FastAPI route?

A

oauth2_scheme = OAuth2PasswordBearer(tokenUrl='token')

@app.get('/items')
async def read_items(token: str = Depends(oauth2_scheme)):
    return {'token': token}

B

oauth2_scheme = OAuth2PasswordBearer(tokenUrl='token')

@app.get('/items')
async def read_items(token: OAuth2PasswordBearer = Depends()):
    return {'token': token}

C

oauth2_scheme = OAuth2PasswordBearer(tokenUrl='token')

@app.get('/items')
async def read_items(token: str):
    return {'token': token}

D

oauth2_scheme = OAuth2PasswordBearer(tokenUrl='token')

@app.get('/items')
async def read_items(token: str = oauth2_scheme):
    return {'token': token}

💡 Hint

Remember how Depends is used to inject dependencies in FastAPI.

Option A correctly creates an OAuth2PasswordBearer instance and uses Depends to inject the token string into the route function parameter.

🔧 Debug

advanced

Why does this protected route always return 401 Unauthorized?

Examine the code below. The route always returns 401 Unauthorized even with correct credentials. What is the cause?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBasic, HTTPBasicCredentials

app = FastAPI()
security = HTTPBasic()

@app.get('/secure')
def secure_route(credentials: HTTPBasicCredentials = Depends(security)):
    if credentials.username == 'user' and credentials.password == 'pass':
        return {'message': 'Welcome!'}
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail='Invalid credentials')

# Client sends username 'user' and password 'pass' but gets 401 Unauthorized

A The client is not sending credentials in the correct HTTP Basic Authorization header format

B The security dependency is not called because Depends is missing

C The route function is missing async keyword causing authentication failure

D The HTTPException status code should be 403 Forbidden instead of 401 Unauthorized

💡 Hint

Check how HTTP Basic authentication expects credentials from the client.

The most common cause is the client not sending the Authorization header properly formatted as 'Basic base64encoded(username:password)'. The server then rejects the request with 401 Unauthorized.

🧠 Conceptual

expert

What is the main benefit of using dependency injection for protected routes in FastAPI?

Why does FastAPI use dependency injection (Depends) to handle authentication in protected routes?

A It automatically encrypts all route responses for security

B It forces all routes to require authentication even if not needed

C It allows reusing authentication logic across multiple routes without repeating code

D It disables access to routes during server startup

💡 Hint

Think about how dependencies help organize code in FastAPI.

Dependency injection lets you write authentication logic once and apply it to many routes easily, improving code reuse and maintainability.