Decorator for role requirement in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a decorator in Flask?

A decorator in Flask is a function that wraps another function to add extra behavior without changing the original function's code. It is often used to modify routes or add checks like authentication.

beginner

Why use a role requirement decorator in Flask?

A role requirement decorator checks if a user has the right role before allowing access to a route. It helps protect parts of a web app so only users with certain roles can use them.

intermediate

How does the @wraps decorator help when creating a custom decorator?

The @wraps decorator preserves the original function's name and docstring when it is wrapped by a decorator. This helps with debugging and keeps the function's identity clear.

beginner

What happens if a user without the required role tries to access a Flask route protected by a role requirement decorator?

The decorator will stop the user from accessing the route, usually by returning a 403 Forbidden error or redirecting them to a login or error page.

intermediate

Example: What does this Flask decorator do? @role_required('admin') def admin_panel(): pass

This decorator checks if the current user has the 'admin' role before running the admin_panel function. If the user is not an admin, access is denied.

What is the main purpose of a role requirement decorator in Flask?

A To speed up the Flask app

B To log user activity

C To change the URL of a route

D To check if a user has a specific role before accessing a route

A role requirement decorator ensures only users with the right role can access certain routes.

Which Python module helps preserve function metadata when writing decorators?

A functools

B os

C sys

D json

The functools module provides the @wraps decorator to preserve function metadata.

If a user lacks the required role, what HTTP status code is commonly returned?

A 403 Forbidden

B 200 OK

C 404 Not Found

D 500 Internal Server Error

403 Forbidden indicates the user is not allowed to access the resource.

In Flask, where is the current user's role usually stored for checking in decorators?

A In the request headers

B In the session or user object

C In the URL parameters

D In the database only

User roles are typically stored in the session or user object accessible during the request.

What does the @wraps decorator do inside a custom decorator?

A Changes the function's behavior

B Runs the function twice

C Preserves the original function's name and docstring

D Prevents the function from running

@wraps keeps the original function's metadata intact after decoration.

Explain how to create a Flask decorator that restricts access based on user roles.

Think about wrapping the route function and checking user roles before running it.

Describe what happens when a user without the required role tries to access a protected Flask route.

Focus on the flow of control when role validation fails.