Response headers in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a custom response header in Flask.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def home():
    response = make_response('Hello World')
    response.headers['[1]'] = 'MyValue'
    return response

Drag options to blanks, or click blank then click option'

AAccept

BContent-Type

CAuthorization

DX-Custom-Header

Attempts:

3 left

💡 Hint

Common Mistakes

Using standard headers like Content-Type instead of a custom header.

Not using make_response to create a response object.

The header name X-Custom-Header is used to set a custom header in the response.

2fill in blank

medium

Complete the code to add a Content-Type header for JSON response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/data')
def data():
    response = make_response('{"key": "value"}')
    response.headers['Content-Type'] = '[1]'
    return response

Drag options to blanks, or click blank then click option'

Atext/plain

Btext/html

Capplication/json

Dapplication/xml

Attempts:

3 left

💡 Hint

Common Mistakes

Using text/html for JSON data.

Forgetting to set Content-Type header.

The Content-Type header should be set to application/json when returning JSON data.

3fill in blank

hard

Fix the error in setting multiple headers in Flask response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/multi')
def multi():
    response = make_response('Multiple headers')
    response.headers['Cache-Control'] = '[1]'
    response.headers['Pragma'] = 'no-cache'
    return response

Drag options to blanks, or click blank then click option'

Apublic

Bno-store

Cprivate

Dcache

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'cache' which enables caching.

Confusing Cache-Control with Pragma header.

The Cache-Control header with value no-store tells browsers not to cache the response.

4fill in blank

hard

Fill both blanks to set security headers in Flask response.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/secure')
def secure():
    response = make_response('Secure headers')
    response.headers['[1]'] = 'deny'
    response.headers['[2]'] = '1; mode=block'
    return response

Drag options to blanks, or click blank then click option'

AX-Frame-Options

BContent-Security-Policy

CX-XSS-Protection

DStrict-Transport-Security

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up header names and values.

Using Content-Security-Policy or Strict-Transport-Security incorrectly here.

X-Frame-Options with value deny prevents clickjacking.
X-XSS-Protection with 1; mode=block enables XSS filtering in browsers.

5fill in blank

hard

Fill all three blanks to create a Flask response with CORS headers.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/cors')
def cors():
    response = make_response('CORS enabled')
    response.headers['[1]'] = '*'
    response.headers['[2]'] = 'GET, POST'
    response.headers['[3]'] = 'Content-Type'
    return response

Drag options to blanks, or click blank then click option'

AAccess-Control-Allow-Origin

BAccess-Control-Allow-Methods

CAccess-Control-Allow-Headers

DAccess-Control-Expose-Headers

Attempts:

3 left

💡 Hint

Common Mistakes

Using Access-Control-Expose-Headers instead of Allow-Headers.

Not setting Access-Control-Allow-Origin to '*' for open access.

To enable CORS, set Access-Control-Allow-Origin to allow origins, Access-Control-Allow-Methods to specify allowed HTTP methods, and Access-Control-Allow-Headers to specify allowed headers.