Admin panel protection in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a non-admin user tries to access the admin panel?

Consider this Flask route protecting an admin panel:

from flask import Flask, session, redirect, url_for
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/admin')
def admin_panel():
    if session.get('role') != 'admin':
        return redirect(url_for('login'))
    return 'Welcome to admin panel'

What will a user with session role 'user' see when visiting '/admin'?

A They see a blank page with no content.

B They see the text 'Welcome to admin panel'.

C They get a 404 Not Found error.

D They get redirected to the login page.

💡 Hint

Check what happens when the session role is not 'admin'.

The code checks if the session role is 'admin'. If not, it redirects to the login page. So a user with role 'user' is redirected.

📝 Syntax

intermediate

Identify the syntax error in this Flask admin check

What is wrong with this Flask route code?

@app.route('/admin')
def admin():
    if session['role'] = 'admin':
        return 'Admin access'
    return 'Access denied'

A The return statements must be inside a try block.

B session['role'] should be session.get('role').

C Using '=' instead of '==' in the if condition.

D Missing parentheses in the route decorator.

💡 Hint

Check the operator used in the if statement.

The '=' operator is for assignment, not comparison. The correct operator is '=='.

❓ state_output

advanced

What is the output after setting session role to admin?

Given this Flask snippet:

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/set_admin')
def set_admin():
    session['role'] = 'admin'
    return 'Role set'

@app.route('/admin')
def admin():
    if session.get('role') == 'admin':
        return 'Welcome admin'
    return 'Access denied'

What will a user see after visiting '/set_admin' then '/admin' in the same browser session?

A First 'Role set', then 'Access denied'.

B First 'Role set', then 'Welcome admin'.

C Both routes return 'Access denied'.

D Both routes return 'Role set'.

💡 Hint

Session data persists between requests in the same browser.

Setting session['role'] to 'admin' stores it. The next request sees this and allows admin access.

🔧 Debug

advanced

Why does this admin check always deny access?

Examine this Flask code:

@app.route('/admin')
def admin():
    if session.get('role') is 'admin':
        return 'Admin panel'
    return 'Denied'

Even when session['role'] is set to 'admin', users see 'Denied'. Why?

A Using 'is' for string comparison causes the check to fail.

B session.get('role') returns None always.

C The route decorator is missing parentheses.

D Flask sessions do not support string values.

💡 Hint

Check how string comparison should be done in Python.

'is' checks identity, not equality. Use '==' to compare string values.

🧠 Conceptual

expert

Which method best secures an admin panel in Flask?

You want to protect your Flask admin panel so only logged-in admins can access it. Which approach is best?

A Check session role in each admin route and redirect unauthorized users.

B Use a global variable to store admin status and check it in routes.

C Allow all users to access admin routes but hide admin content with JavaScript.

D Store admin password in plain text and check it on every request.

💡 Hint

Think about secure, server-side checks for user roles.

Checking session role server-side in each route is secure and reliable. Global variables or client-side hiding are insecure. Plain text passwords are unsafe.

Practice

1. What is the main purpose of protecting an admin panel in a Flask app?

easy

A. To restrict access only to authorized users

B. To make the page load faster

C. To change the page style dynamically

D. To allow everyone to view admin data

Solution

1. Step 1: Understand admin panel purpose

   The admin panel contains sensitive controls and data that should not be public.

2. Step 2: Identify protection goal

   Protecting means only authorized users can access it, preventing unauthorized access.

3. Final Answer:

   To restrict access only to authorized users -> Option A

4. Quick Check:

   Admin panel protection = restrict access [OK]

Hint: Admin panel must be private, not public [OK]

Common Mistakes:

• Thinking protection speeds up the page
• Confusing style changes with security
• Allowing all users access

2. Which Flask feature is commonly used to remember if a user is logged in for admin access?

easy

A. Flask sessions

B. Flask blueprints

C. Flask templates

D. Flask static files

Solution

1. Step 1: Recall Flask features

   Sessions store data across requests, like login status.

2. Step 2: Match feature to login tracking

   Sessions keep track of user login state, enabling admin protection.

3. Final Answer:

   Flask sessions -> Option A

4. Quick Check:

   Login status stored in sessions [OK]

Hint: Use sessions to track login state [OK]

Common Mistakes:

• Confusing blueprints with login storage
• Thinking templates store login info
• Using static files for user data

3. What will happen if this Flask route code runs and the user is not logged in?

from flask import session, redirect, url_for

@app.route('/admin')
def admin_panel():
    if not session.get('logged_in'):
        return redirect(url_for('login'))
    return 'Welcome to admin panel'

medium

A. User sees 'Welcome to admin panel'

B. App crashes with an error

C. User is redirected to the login page

D. User sees a blank page

Solution

1. Step 1: Check login condition

   The code checks if 'logged_in' is not in session or False.

2. Step 2: Follow redirect logic

   If not logged in, it redirects user to the 'login' route.

3. Final Answer:

   User is redirected to the login page -> Option C

4. Quick Check:

   Not logged in triggers redirect [OK]

Hint: If not logged_in, redirect to login [OK]

Common Mistakes:

• Assuming user sees admin content without login
• Expecting an error instead of redirect
• Thinking blank page appears

4. Identify the error in this Flask admin route code:

from flask import session, redirect, url_for

@app.route('/admin')
def admin_panel():
    if session['logged_in'] == False:
        return redirect(url_for('login'))
    return 'Admin content'

medium

A. Using url_for incorrectly

B. Using session['logged_in'] without checking if key exists

C. Missing return statement after redirect

D. Redirecting to login instead of admin

Solution

1. Step 1: Check session key access

   Accessing session['logged_in'] directly causes error if key missing.

2. Step 2: Explain safe access method

   Use session.get('logged_in') to avoid KeyError if key absent.

3. Final Answer:

   Using session['logged_in'] without checking if key exists -> Option B

4. Quick Check:

   Direct session key access risks KeyError [OK]

Hint: Use session.get() to avoid missing key errors [OK]

Common Mistakes:

• Ignoring KeyError risk on missing session key
• Thinking redirect needs extra return
• Misusing url_for function

5. You want to protect your Flask admin panel so only logged-in users can access it. Which code snippet correctly implements this protection?

hard

A. return 'Admin panel content' # No login check needed

B. if session.get('logged_in'):
return redirect(url_for('login'))
return 'Admin panel content'

C. if session['logged_in'] == False:
return 'Admin panel content'
else:
return redirect(url_for('login'))

D. if not session.get('logged_in'):
return redirect(url_for('login'))
return 'Admin panel content'

Solution

1. Step 1: Check login condition correctly

   We want to redirect if user is NOT logged in, so use if not session.get('logged_in').

2. Step 2: Return admin content only if logged in

   After redirecting unauthorized users, show admin content to logged-in users.

3. Final Answer:

   if not session.get('logged_in'): return redirect(url_for('login')) return 'Admin panel content' -> Option D

4. Quick Check:

   Redirect unauthorized, show admin if logged in [OK]

Hint: Redirect if NOT logged in, else show admin [OK]

Common Mistakes:

• Redirecting logged-in users instead of unauthorized
• Using direct session key access without get()
• Skipping login check entirely