Response headers in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a custom response header in Flask.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def home():
    response = make_response('Hello World')
    response.headers['[1]'] = 'MyValue'
    return response

Drag options to blanks, or click blank then click option'

AAccept

BContent-Type

CAuthorization

DX-Custom-Header

Attempts:

3 left

💡 Hint

Common Mistakes

Using standard headers like Content-Type instead of a custom header.

Not using make_response to create a response object.

The header name X-Custom-Header is used to set a custom header in the response.

2fill in blank

medium

Complete the code to add a Content-Type header for JSON response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/data')
def data():
    response = make_response('{"key": "value"}')
    response.headers['Content-Type'] = '[1]'
    return response

Drag options to blanks, or click blank then click option'

Atext/plain

Btext/html

Capplication/json

Dapplication/xml

Attempts:

3 left

💡 Hint

Common Mistakes

Using text/html for JSON data.

Forgetting to set Content-Type header.

The Content-Type header should be set to application/json when returning JSON data.

3fill in blank

hard

Fix the error in setting multiple headers in Flask response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/multi')
def multi():
    response = make_response('Multiple headers')
    response.headers['Cache-Control'] = '[1]'
    response.headers['Pragma'] = 'no-cache'
    return response

Drag options to blanks, or click blank then click option'

Apublic

Bno-store

Cprivate

Dcache

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'cache' which enables caching.

Confusing Cache-Control with Pragma header.

The Cache-Control header with value no-store tells browsers not to cache the response.

4fill in blank

hard

Fill both blanks to set security headers in Flask response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/secure')
def secure():
    response = make_response('Secure headers')
    response.headers['[1]'] = 'deny'
    response.headers['[2]'] = '1; mode=block'
    return response

Drag options to blanks, or click blank then click option'

AX-Frame-Options

BContent-Security-Policy

CX-XSS-Protection

DStrict-Transport-Security

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up header names and values.

Using Content-Security-Policy or Strict-Transport-Security incorrectly here.

X-Frame-Options with value deny prevents clickjacking.
X-XSS-Protection with 1; mode=block enables XSS filtering in browsers.

5fill in blank

hard

Fill all three blanks to create a Flask response with CORS headers.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/cors')
def cors():
    response = make_response('CORS enabled')
    response.headers['[1]'] = '*'
    response.headers['[2]'] = 'GET, POST'
    response.headers['[3]'] = 'Content-Type'
    return response

Drag options to blanks, or click blank then click option'

AAccess-Control-Allow-Origin

BAccess-Control-Allow-Methods

CAccess-Control-Allow-Headers

DAccess-Control-Expose-Headers

Attempts:

3 left

💡 Hint

Common Mistakes

Using Access-Control-Expose-Headers instead of Allow-Headers.

Not setting Access-Control-Allow-Origin to '*' for open access.

To enable CORS, set Access-Control-Allow-Origin to allow origins, Access-Control-Allow-Methods to specify allowed HTTP methods, and Access-Control-Allow-Headers to specify allowed headers.

Practice

1. What is the purpose of response headers in a Flask web application?

easy

A. To send extra information from the server to the browser

B. To store user data on the server

C. To write data into the database

D. To create HTML content dynamically

Solution

1. Step 1: Understand what response headers do

   Response headers carry extra information about the response, like content type or caching rules.

2. Step 2: Identify their role in Flask

   In Flask, response headers are sent from the server to the browser to control how the browser handles the response.

3. Final Answer:

   To send extra information from the server to the browser -> Option A

4. Quick Check:

   Response headers = extra info sent to browser [OK]

Hint: Response headers send info from server to browser [OK]

Common Mistakes:

• Confusing headers with server-side data storage
• Thinking headers create HTML content
• Mixing headers with database operations

2. Which of the following is the correct way to add a custom header X-Custom-Header with value Test to a Flask response?

easy

A. response.set_header('X-Custom-Header', 'Test')

B. response.add_header('X-Custom-Header', 'Test')

C. response.header('X-Custom-Header', 'Test')

D. response.headers['X-Custom-Header'] = 'Test'

Solution

1. Step 1: Recall Flask response header syntax

   In Flask, headers are set by assigning values to keys in the response.headers dictionary.

2. Step 2: Match the correct syntax

   Only response.headers['X-Custom-Header'] = 'Test' uses the correct dictionary assignment syntax.

3. Final Answer:

   response.headers['X-Custom-Header'] = 'Test' -> Option D

4. Quick Check:

   Use dictionary assignment for headers [OK]

Hint: Set headers by assigning to response.headers dict [OK]

Common Mistakes:

• Using non-existent methods like add_header or set_header
• Calling response.header() which does not exist
• Trying to set headers as function calls

3. Given this Flask code snippet, what will be the value of the Content-Type header in the response?

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hello')
    response.headers['Content-Type'] = 'application/json'
    return response

medium

A. text/html

B. application/json

C. text/plain

D. application/xml

Solution

1. Step 1: Check the header assignment in the code

   The code sets response.headers['Content-Type'] = 'application/json', which overrides the default.

2. Step 2: Understand the effect on response

   This means the response will have the Content-Type header set to application/json.

3. Final Answer:

   application/json -> Option B

4. Quick Check:

   Content-Type header = application/json [OK]

Hint: Headers set in code override defaults [OK]

Common Mistakes:

• Assuming default Content-Type without checking header override
• Confusing Content-Type with response body content
• Ignoring header assignment line

4. What is wrong with this Flask code that tries to add a header?

from flask import Flask
app = Flask(__name__)

@app.route('/')
def home():
    response = 'Hello'
    response.headers['X-Test'] = 'Value'
    return response

medium

A. You cannot add headers to a string response directly

B. The header key must be lowercase

C. The header value must be an integer

D. Flask does not support custom headers

Solution

1. Step 1: Identify the response type

   The response is a plain string, not a response object.

2. Step 2: Understand header assignment requirements

   Headers can only be set on response objects, not on strings.

3. Final Answer:

   You cannot add headers to a string response directly -> Option A

4. Quick Check:

   Headers require response object, not string [OK]

Hint: Headers need response object, not plain string [OK]

Common Mistakes:

• Trying to set headers on string instead of response
• Thinking header keys must be lowercase
• Believing Flask disallows custom headers

5. You want to add a header Cache-Control with value no-store to all responses in your Flask app. Which is the best way to do this?

hard

A. Set Cache-Control in the HTML meta tags

B. Add response.headers['Cache-Control'] = 'no-store' inside every route function

C. Use a @app.after_request function to add the header to all responses

D. Modify the Flask source code to add the header globally

Solution

1. Step 1: Understand the goal

   You want to add the header to all responses automatically, not manually in each route.

2. Step 2: Identify Flask feature for global response modification

   The @app.after_request decorator lets you modify every response before sending it.

3. Step 3: Evaluate options

   The @app.after_request decorator adds the header to every response automatically, which is efficient and clean.

4. Final Answer:

   Use a @app.after_request function to add the header to all responses -> Option C

5. Quick Check:

   Use after_request to set headers globally [OK]

Hint: Use @app.after_request to add headers globally [OK]

Common Mistakes:

• Adding header manually in every route (Option B)
• Trying to set headers in HTML meta tags (Option C)
• Editing Flask source code (Option D)