How cookies work in HTTP in Flask - Quick Revision & Summary

Recall & Review

beginner

What is a cookie in the context of HTTP?

A cookie is a small piece of data sent from a website and stored on the user's browser. It helps remember information about the user between requests.

beginner

How does a server send a cookie to a client in HTTP?

The server sends a cookie using the 'Set-Cookie' header in the HTTP response. The browser then stores this cookie.

beginner

How does the browser send cookies back to the server?

The browser includes stored cookies in the 'Cookie' header of subsequent HTTP requests to the same server.

intermediate

In Flask, how do you set a cookie in a response?

Use the 'set_cookie' method on the response object, for example: response.set_cookie('key', 'value').

intermediate

What are some common cookie attributes that control cookie behavior?

Attributes include 'Expires' or 'Max-Age' (lifetime), 'Path' (URL scope), 'Domain' (which domains can access), 'Secure' (only over HTTPS), and 'HttpOnly' (not accessible by JavaScript).

Which HTTP header does the server use to send a cookie to the client?

A Authorization

B Cookie

C Set-Cookie

D Content-Type

The server uses the 'Set-Cookie' header to send cookies to the client.

When the browser sends cookies back to the server, which header is used?

A Cookie

B User-Agent

C Set-Cookie

D Referer

The browser sends cookies in the 'Cookie' header with HTTP requests.

In Flask, which method sets a cookie on the response object?

A response.set_cookie()

B request.set_cookie()

C response.get_cookie()

D request.get_cookie()

You use response.set_cookie() to add a cookie to the HTTP response in Flask.

What does the 'HttpOnly' cookie attribute do?

A Makes cookie accessible only via JavaScript

B Prevents cookie from being sent over HTTPS

C Deletes the cookie immediately

D Prevents JavaScript access to the cookie

'HttpOnly' makes the cookie inaccessible to JavaScript, improving security.

Which cookie attribute restricts the cookie to HTTPS connections only?

A HttpOnly

B Secure

C Domain

D Path

The 'Secure' attribute ensures the cookie is sent only over HTTPS.

Explain how cookies are created, stored, and sent back in HTTP communication.

Think about the journey of a cookie from server to browser and back.

Describe how to set and read cookies in a Flask web application.

Consider Flask's request and response objects.

Practice

1. What is the main purpose of cookies in HTTP when using Flask?

easy

A. To store small pieces of data on the user's browser for later use

B. To increase the speed of the Flask server

C. To encrypt user data on the server

D. To manage database connections automatically

Solution

1. Step 1: Understand what cookies do in HTTP

   Cookies store small data on the user's browser to remember information between requests.

2. Step 2: Identify Flask's use of cookies

   Flask uses cookies to save user preferences or login info on the client side.

3. Final Answer:

   To store small pieces of data on the user's browser for later use -> Option A

4. Quick Check:

   Cookies store data on browser = D [OK]

Hint: Cookies save small data on browser, not server speed [OK]

Common Mistakes:

• Thinking cookies speed up the server
• Confusing cookies with encryption
• Assuming cookies manage databases

2. Which Flask method is used to set a cookie in the HTTP response?

easy

A. request.set_cookie()

B. request.cookies()

C. response.set_cookie()

D. response.cookies()

Solution

1. Step 1: Recall Flask's cookie setting method

   Cookies are set on the response object, not the request.

2. Step 2: Identify the correct method

   The method to set a cookie is set_cookie() on the response object.

3. Final Answer:

   response.set_cookie() -> Option C

4. Quick Check:

   Set cookie on response = C [OK]

Hint: Set cookies on response, read from request [OK]

Common Mistakes:

• Using request.set_cookie() instead of response.set_cookie()
• Confusing request.cookies() as a setter
• Using response.cookies() which does not exist

3. Given this Flask code snippet, what will be printed when the client sends a cookie named 'user' with value 'Alice'?

from flask import Flask, request
app = Flask(__name__)

@app.route('/')
def index():
    user = request.cookies.get('user')
    return f'Hello, {user}!'

medium

A. Hello, Alice!

B. Hello, !

C. Hello, None!

D. Hello, user!

Solution

1. Step 1: Understand how Flask reads cookies

   The code uses request.cookies.get('user') to get the cookie value named 'user'.

2. Step 2: Check the cookie value sent by client

   The client sends a cookie 'user' with value 'Alice', so user variable will be 'Alice'.

3. Final Answer:

   Hello, Alice! -> Option A

4. Quick Check:

   Cookie 'user' = Alice, output = A [OK]

Hint: request.cookies.get('name') returns cookie value or None [OK]

Common Mistakes:

• Assuming cookie value is None if present
• Forgetting to use .get() method
• Confusing cookie name with literal string

4. What is wrong with this Flask code that tries to set a cookie?

from flask import Flask, request
app = Flask(__name__)

@app.route('/')
def index():
    response = 'Hello'
    response.set_cookie('theme', 'dark')
    return response

medium

A. The cookie name 'theme' is invalid

B. You cannot set cookies on a string response object

C. The set_cookie method requires a third argument

D. Flask does not support cookies

Solution

1. Step 1: Identify the response object type

   The variable response is a string, not a Flask response object.

2. Step 2: Understand how to set cookies in Flask

   Cookies can only be set on a response object, like one created by make_response(), not on a plain string.

3. Final Answer:

   You cannot set cookies on a string response object -> Option B

4. Quick Check:

   Set cookies on response object, not string = B [OK]

Hint: Use make_response() to set cookies, not plain strings [OK]

Common Mistakes:

• Trying to set cookies on string instead of response object
• Thinking cookie names must be special
• Believing set_cookie needs extra arguments always

5. You want to create a Flask route that sets a cookie named 'visited' with value 'yes' that expires in 1 day. Which code correctly does this?

hard

A. from flask import make_response
@app.route('/')
def index():
resp = make_response('Welcome')
resp.cookies['visited'] = 'yes'
return resp

B. @app.route('/')
def index():
response = 'Welcome'
response.set_cookie('visited', 'yes', max_age=86400)
return response

C. from flask import request
@app.route('/')
def index():
request.set_cookie('visited', 'yes', max_age=86400)
return 'Welcome'

D. from flask import make_response
@app.route('/')
def index():
resp = make_response('Welcome')
resp.set_cookie('visited', 'yes', max_age=86400)
return resp

Solution

1. Step 1: Identify how to create a response object

   Use make_response() to create a response object to set cookies.

2. Step 2: Set cookie with expiration

   Use set_cookie() with max_age=86400 (seconds in 1 day) to set expiration.

3. Step 3: Check each option

   from flask import make_response @app.route('/') def index(): resp = make_response('Welcome') resp.set_cookie('visited', 'yes', max_age=86400) return resp correctly uses make_response and set_cookie with max_age. Others either set cookie on string or request or use wrong syntax.

4. Final Answer:

   resp.set_cookie('visited', 'yes', max_age=86400) -> Option D

5. Quick Check:

   Use make_response + set_cookie + max_age = A [OK]

Hint: Use make_response and set_cookie with max_age for expiry [OK]

Common Mistakes:

• Setting cookie on string instead of response object
• Trying to set cookie on request object
• Using resp.cookies dict instead of set_cookie method