How cookies work in HTTP in Flask - Practice Exercises

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this Flask route do with cookies?

Consider this Flask route that sets a cookie. What will the browser receive after visiting this route?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/set')
def set_cookie():
    resp = make_response('Cookie is set')
    resp.set_cookie('user', 'alice')
    return resp

A The server returns an error because set_cookie is not a valid method.

B The cookie is set but the response body is empty.

C The response body contains 'user=alice', but no cookie is set in the browser.

D The response includes a Set-Cookie header with user=alice, and the page shows 'Cookie is set'.

💡 Hint

Look at how make_response and set_cookie work together.

The make_response function creates a response object. Using set_cookie adds a Set-Cookie header. The browser receives this header and stores the cookie. The response body is 'Cookie is set'.

❓ state_output

intermediate

What value does the server read from the cookie?

Given this Flask route that reads a cookie, what will be printed if the browser sends a cookie user=bob?

Flask

from flask import Flask, request
app = Flask(__name__)

@app.route('/get')
def get_cookie():
    user = request.cookies.get('user')
    return f'User is {user}'

A User is '' (empty string)

B User is None

C User is bob

D The server raises a KeyError

💡 Hint

Check how request.cookies.get works when the cookie exists.

request.cookies.get('user') returns the value of the cookie named 'user'. If the browser sends user=bob, the value is 'bob'.

📝 Syntax

advanced

Which option correctly deletes a cookie in Flask?

You want to delete the cookie named 'session' in Flask. Which code snippet correctly does this?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/logout')
def logout():
    resp = make_response('Logged out')
    # delete cookie here
    return resp

A resp.delete_cookie('session')

B resp.set_cookie('session', '', max_age=0)

C resp.remove_cookie('session')

D resp.set_cookie('session', None)

💡 Hint

Look for the Flask Response method that removes cookies.

Flask's Response object has a delete_cookie method to remove cookies by setting expiration in the past.

🔧 Debug

advanced

Why does this cookie not get set in the browser?

This Flask code tries to set a cookie but the browser never stores it. What is the problem?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/set')
def set_cookie():
    resp = make_response('Setting cookie')
    resp.set_cookie('token', 'abc123', httponly=True, secure=True)
    return 'Cookie set'

A The secure=True flag prevents the cookie from being set on HTTP connections.

B The response returns a string instead of the response object with the cookie.

C httponly=True disables the cookie from being stored.

D The cookie name 'token' is reserved and cannot be used.

💡 Hint

Check what the route returns.

The route returns a plain string, not the response object with the cookie header. The cookie header is lost.

🧠 Conceptual

expert

How does the browser decide which cookies to send with a request?

When a browser makes an HTTP request, which cookies does it include in the request headers?

A Only cookies matching the request domain and path, and respecting Secure and HttpOnly flags.

B All cookies stored by the browser regardless of domain or path.

C Only cookies set in the last 24 hours.

D Cookies are sent only if the request is a POST method.

💡 Hint

Think about cookie scope and security flags.

Browsers send cookies only if the cookie domain and path match the request URL, and Secure cookies only over HTTPS. HttpOnly affects JavaScript access, not sending.