Why sessions manage user state in Flask - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why do sessions store user data on the server side?

In Flask, sessions help keep track of user information across requests. Why is it important that session data is stored on the server side rather than only in the browser?

A Because storing data on the server keeps it secure and prevents users from changing it directly.

B Because browsers cannot store any data at all, so server storage is the only option.

C Because server storage makes the website load faster by avoiding browser caching.

D Because sessions only work if data is stored in cookies on the client side.

💡 Hint

Think about what could happen if users could change their own session data.

Sessions store data on the server to keep it safe and prevent tampering. If data was only on the client, users could change it and cause errors or security issues.

❓ component_behavior

intermediate

What happens to session data when a user closes their browser?

Consider a Flask app using sessions to track user login status. What happens to the session data if the user closes their browser and then reopens the site?

A The browser saves all session data permanently, so the user never needs to log in again.

B The session data stays forever on the server and automatically logs the user back in.

C The server deletes the session data immediately when the browser closes.

D The session data is lost if the session cookie is not persistent, so the user must log in again.

💡 Hint

Think about how cookies control session lifetime.

Session cookies usually expire when the browser closes unless set to persist. Without a persistent cookie, the session ID is lost, so the server cannot recognize the user and requires login again.

📝 Syntax

advanced

Identify the correct way to set a session variable in Flask

Which option correctly sets a session variable named 'username' to 'alice' in a Flask route?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/')
def index():
    # Set session variable here
    pass
    return 'Done'

A session['username'] = 'alice'

B session.username = 'alice'

C session.add('username', 'alice')

D session.set('username', 'alice')

💡 Hint

Remember how to use dictionary syntax in Python.

Flask sessions behave like dictionaries. You set values using square brackets and assignment, like session['key'] = value.

❓ state_output

advanced

What is the output after modifying session data in Flask?

Given this Flask route, what will be the output when visiting '/count' three times in a row?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/count')
def count():
    if 'visits' in session:
        session['visits'] += 1
    else:
        session['visits'] = 1
    return f"Visit number: {session['visits']}"

A Visit number: 1 every time because session resets

B Visit number: 1, then 2, then 3 on consecutive visits

C Visit number: 3 on the first visit and stays the same

D Error because session['visits'] is not initialized

💡 Hint

Think about how session data persists between requests.

The session keeps track of 'visits' and increments it each time the route is accessed, so the output counts up on each visit.

🔧 Debug

expert

Why does this Flask session code raise an error?

Examine this Flask route code. Why does it raise a RuntimeError: Working outside of request context when trying to access session?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

user_session = session

@app.route('/')
def index():
    user_session['logged_in'] = True
    return 'Logged in'

A Because the route function must return a JSON response, not a string.

B Because the secret key is missing, so session cannot be used.

C Because session can only be accessed inside a request context, not at the module level.

D Because session must be imported from flask.sessions, not flask.

💡 Hint

Think about when Flask creates the session object.

The session object is only available during a request. Assigning it outside a route causes the error because no request context exists yet.