Secret key configuration in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens if Flask app's secret key is not set?

Consider a Flask app where the secret_key is not configured. What will happen when you try to use sessions?

Flask

from flask import Flask, session
app = Flask(__name__)

@app.route('/')
def index():
    session['user'] = 'Alice'
    return 'Session set!'

if __name__ == '__main__':
    app.run()

A Flask will raise a RuntimeError complaining about missing secret key.

B The session data will be stored securely and encrypted.

C Session data will be stored but not encrypted, causing a warning.

D The app will crash immediately on startup.

💡 Hint

Think about what Flask requires to sign session cookies.

Flask needs a secret key to sign session cookies. Without it, Flask raises a RuntimeError when you try to use sessions.

📝 Syntax

intermediate

Which code correctly sets a secret key in Flask?

Choose the correct way to set a secret key for a Flask app.

Flask

from flask import Flask
app = Flask(__name__)

# Set secret key here

A app.config['SECRET_KEY'] = 'mysecret'

B app.secret_key = 'mysecret'

C app.set_secret_key('mysecret')

D app.secretKey = 'mysecret'

💡 Hint

Flask configuration keys are usually uppercase strings.

The correct way is to set app.config['SECRET_KEY']. The attribute app.secret_key also works as a convenience property, but set_secret_key or secretKey do not exist.

❓ state_output

advanced

What is the output when secret key changes between requests?

Given a Flask app that sets a new random secret key on every request, what happens to the session data?

Flask

from flask import Flask, session
import os

app = Flask(__name__)

@app.before_request
def set_key():
    app.config['SECRET_KEY'] = os.urandom(16)

@app.route('/')
def index():
    session['count'] = session.get('count', 0) + 1
    return f"Count: {session['count']}"

if __name__ == '__main__':
    app.run()

A The count will increment on each refresh as expected.

B The count will reset to 1 on every request.

C Flask will raise an error about changing secret key during request.

D The session will persist but with corrupted data.

💡 Hint

Think about how Flask uses the secret key to sign session cookies.

Changing the secret key invalidates previous session cookies, so the session data resets each time.

🔧 Debug

advanced

Why does this Flask app's session data not persist?

Review the code below. The session data does not persist between requests. What is the cause?

Flask

from flask import Flask, session
app = Flask(__name__)

app.config['SECRET_KEY'] = 'abc123'

@app.route('/')
def index():
    session['visits'] = session.get('visits', 0) + 1
    return f"Visits: {session['visits']}"

if __name__ == '__main__':
    app.run(debug=True, use_reloader=True)

A The app is running with debug and use_reloader, causing the secret key to reset.

B Session data requires a database backend configured.

C The session key must be set inside the route function.

D The secret key is too short and Flask ignores it.

💡 Hint

Consider what happens when Flask reloads the app in debug mode.

When using use_reloader=True, Flask restarts the app process, which can reset the secret key if set dynamically. Here it is static, but the reloader causes multiple app instances, confusing session persistence.

🧠 Conceptual

expert

Why should Flask's secret key be kept secret and unpredictable?

Choose the best explanation for why Flask's SECRET_KEY must be kept secret and hard to guess.

A Because it encrypts all data sent to the client, preventing snooping.

B Because it controls the Flask app's debug mode and error messages.

C Because it is used to hash passwords stored in the database.

D Because it signs session cookies to prevent tampering and impersonation.

💡 Hint

Think about what the secret key is used for in Flask sessions.

The secret key is used to cryptographically sign session cookies. If it is guessable, attackers can forge cookies and impersonate users.