Admin panel protection in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a non-admin user tries to access the admin panel?

Consider this Flask route protecting an admin panel:

from flask import Flask, session, redirect, url_for
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/admin')
def admin_panel():
    if session.get('role') != 'admin':
        return redirect(url_for('login'))
    return 'Welcome to admin panel'

What will a user with session role 'user' see when visiting '/admin'?

A They see a blank page with no content.

B They see the text 'Welcome to admin panel'.

C They get a 404 Not Found error.

D They get redirected to the login page.

💡 Hint

Check what happens when the session role is not 'admin'.

The code checks if the session role is 'admin'. If not, it redirects to the login page. So a user with role 'user' is redirected.

📝 Syntax

intermediate

Identify the syntax error in this Flask admin check

What is wrong with this Flask route code?

@app.route('/admin')
def admin():
    if session['role'] = 'admin':
        return 'Admin access'
    return 'Access denied'

A The return statements must be inside a try block.

B session['role'] should be session.get('role').

C Using '=' instead of '==' in the if condition.

D Missing parentheses in the route decorator.

💡 Hint

Check the operator used in the if statement.

The '=' operator is for assignment, not comparison. The correct operator is '=='.

❓ state_output

advanced

What is the output after setting session role to admin?

Given this Flask snippet:

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/set_admin')
def set_admin():
    session['role'] = 'admin'
    return 'Role set'

@app.route('/admin')
def admin():
    if session.get('role') == 'admin':
        return 'Welcome admin'
    return 'Access denied'

What will a user see after visiting '/set_admin' then '/admin' in the same browser session?

A First 'Role set', then 'Access denied'.

B First 'Role set', then 'Welcome admin'.

C Both routes return 'Access denied'.

D Both routes return 'Role set'.

💡 Hint

Session data persists between requests in the same browser.

Setting session['role'] to 'admin' stores it. The next request sees this and allows admin access.

🔧 Debug

advanced

Why does this admin check always deny access?

Examine this Flask code:

@app.route('/admin')
def admin():
    if session.get('role') is 'admin':
        return 'Admin panel'
    return 'Denied'

Even when session['role'] is set to 'admin', users see 'Denied'. Why?

A Using 'is' for string comparison causes the check to fail.

B session.get('role') returns None always.

C The route decorator is missing parentheses.

D Flask sessions do not support string values.

💡 Hint

Check how string comparison should be done in Python.

'is' checks identity, not equality. Use '==' to compare string values.

🧠 Conceptual

expert

Which method best secures an admin panel in Flask?

You want to protect your Flask admin panel so only logged-in admins can access it. Which approach is best?

A Check session role in each admin route and redirect unauthorized users.

B Use a global variable to store admin status and check it in routes.

C Allow all users to access admin routes but hide admin content with JavaScript.

D Store admin password in plain text and check it on every request.

💡 Hint

Think about secure, server-side checks for user roles.

Checking session role server-side in each route is secure and reliable. Global variables or client-side hiding are insecure. Plain text passwords are unsafe.