Role-based access control in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing a protected route with insufficient role?

Consider a FastAPI route protected by a dependency that checks if the user has the 'admin' role. If a user with only the 'user' role tries to access it, what will be the HTTP response status code?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer

app = FastAPI()
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

fake_users_db = {
    "alice": {"username": "alice", "roles": ["user"]},
    "bob": {"username": "bob", "roles": ["admin"]}
}

def get_current_user(token: str = Depends(oauth2_scheme)):
    user = fake_users_db.get(token)
    if not user:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid authentication")
    return user

def require_admin(user: dict = Depends(get_current_user)):
    if "admin" not in user["roles"]:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
    return user

@app.get("/admin")
async def read_admin_data(user: dict = Depends(require_admin)):
    return {"msg": "Welcome admin!"}

A HTTP 403 Forbidden error

B HTTP 200 with message 'Welcome admin!'

C HTTP 401 Unauthorized error

D HTTP 404 Not Found error

💡 Hint

Think about what happens when the user is authenticated but lacks the required role.

The dependency require_admin checks if the user has the 'admin' role. If not, it raises a 403 Forbidden error, indicating the user is authenticated but not authorized to access the resource.

📝 Syntax

intermediate

Which code snippet correctly implements role checking in FastAPI dependency?

Choose the code snippet that correctly checks if the current user has the 'editor' role and raises a 403 error if not.

A

def require_editor(user: dict = Depends(get_current_user)):
    if user.roles != ['editor']:
        raise HTTPException(status_code=403, detail='Forbidden')
    return user

B

def require_editor(user: dict = Depends(get_current_user)):
    if 'editor' not in user['roles']:
        raise HTTPException(status_code=403, detail='Forbidden')
    return user

C

def require_editor(user: dict = Depends(get_current_user)):
    if 'editor' not in user.roles:
        raise HTTPException(status_code=403, detail='Forbidden')
    return user

D

def require_editor(user: dict = Depends(get_current_user)):
    if user['roles'] != 'editor':
        raise HTTPException(status_code=403, detail='Forbidden')
    return user

💡 Hint

Remember that roles are stored as a list inside a dictionary.

Option B correctly checks if the string 'editor' is in the list stored under the 'roles' key in the user dictionary. Other options either compare list to string or use incorrect attribute access.

❓ state_output

advanced

What is the response when a user with multiple roles accesses a route requiring one role?

Given a user with roles ['user', 'editor'] accessing a route protected by a dependency that requires the 'editor' role, what will be the response?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status

app = FastAPI()

fake_users_db = {
    "carol": {"username": "carol", "roles": ["user", "editor"]}
}

def get_current_user(token: str):
    user = fake_users_db.get(token)
    if not user:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)
    return user

def require_editor(user: dict = Depends(get_current_user)):
    if "editor" not in user["roles"]:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
    return user

@app.get("/edit")
async def edit_content(user: dict = Depends(require_editor)):
    return {"msg": f"Hello {user['username']}, you can edit content."}

A HTTP 403 Forbidden error

B HTTP 401 Unauthorized error

C HTTP 404 Not Found error

D {"msg": "Hello carol, you can edit content."}

💡 Hint

Check if the required role is present in the user's roles list.

The user 'carol' has the 'editor' role among others, so the dependency passes and the route returns a success message.

🔧 Debug

advanced

Identify the error in this role check dependency

What error will this FastAPI dependency raise when called?

FastAPI

def require_admin(user: dict = Depends(get_current_user)):
    if user['roles'] != 'admin':
        raise HTTPException(status_code=403, detail='Forbidden')
    return user

A Always raises HTTP 403 even if user has 'admin' role

B Raises KeyError because 'roles' key is missing

C Raises TypeError due to wrong comparison

D Returns user correctly if 'admin' role is present

💡 Hint

Consider the data type of user['roles'] and what the comparison checks.

The code compares a list (user['roles']) to a string ('admin'), which is always False, so the HTTPException is always raised even if 'admin' is in the list.

🧠 Conceptual

expert

Why use dependencies for role-based access control in FastAPI?

Which is the best explanation for why FastAPI uses dependencies to implement role-based access control?

A Dependencies force all routes to require admin role by default, simplifying security.

B Dependencies automatically encrypt user roles to secure them from tampering.

C Dependencies allow reusable, modular checks that run before route logic, enabling clean separation of authorization concerns.

D Dependencies replace the need for authentication by verifying user identity through roles alone.

💡 Hint

Think about how dependencies help organize code and enforce checks.

FastAPI dependencies provide a clean way to run code before route handlers. This lets you check user roles in one place and reuse that logic across routes, keeping code organized and secure.