Email verification pattern in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after a user clicks the email verification link?

In a Flask app using an email verification pattern, what is the typical behavior after the user clicks the verification link sent to their email?

A The app marks the user as verified and redirects them to a confirmation page.

B The app deletes the user account immediately.

C The app sends another verification email automatically.

D The app logs the user out without any message.

💡 Hint

Think about what the verification link is supposed to confirm.

Clicking the verification link confirms the user's email. The app then marks the user as verified and usually shows a confirmation page.

📝 Syntax

intermediate

Which Flask route correctly handles email verification tokens?

Given a Flask app, which route code correctly extracts and verifies an email token from the URL?

Flask

from flask import Flask, request, redirect
app = Flask(__name__)

@app.route('/verify/<token>')
def verify_email(token):
    # Verify token logic here
    pass

A

def verify_email(token):
    # token is a query param
    token = request.args['token']
    # verify token
    return redirect('/confirmed')

B

def verify_email():
    token = request.args.get('token')
    # verify token
    return redirect('/confirmed')

C

def verify_email(token):
    if not token:
        return 'Invalid token', 400
    # verify token
    return redirect('/confirmed')

D

def verify_email(token):
    token = request.form['token']
    # verify token
    return redirect('/confirmed')

💡 Hint

Check how the token is passed in the URL path and accessed in the function.

The route uses a URL parameter <token> which Flask passes as an argument to the function. Option C correctly uses this argument.

❓ state_output

advanced

What is the user status after verification token expires?

In a Flask email verification system, if a user clicks an expired verification token link, what should be the typical user status in the database?

A The user remains unverified and must request a new verification email.

B The user is automatically deleted from the database.

C The user is marked as verified despite the expired token.

D The user is locked out permanently.

💡 Hint

Think about what happens when verification fails due to expiration.

If the token is expired, the user is not verified and must get a new token to verify their email.

🔧 Debug

advanced

Why does this Flask email verification code raise an error?

Consider this Flask route snippet for email verification. Why does it raise a TypeError?

Flask

from flask import Flask, redirect
app = Flask(__name__)

@app.route('/verify/<token>')
def verify_email():
    if not token:
        return 'Invalid token', 400
    # verify token
    return redirect('/confirmed')

A The redirect function is used incorrectly without parentheses.

B The function is missing the 'token' parameter required by the route.

C The route decorator syntax is invalid.

D The 'if not token' check causes a syntax error.

💡 Hint

Check the function parameters matching the route variables.

The route expects a 'token' parameter, but the function does not accept it, causing a TypeError.

🧠 Conceptual

expert

What is the main security risk if email verification tokens are not time-limited?

In an email verification pattern using Flask, what is the main security risk if tokens never expire?

A Emails would be sent repeatedly causing spam.

B Users would be unable to verify their emails at all.

C The server would crash due to token overload.

D Attackers could reuse old tokens to verify unauthorized accounts.

💡 Hint

Think about what happens if tokens stay valid forever.

If tokens never expire, attackers who get old tokens can reuse them to verify accounts fraudulently.

Practice

1. What is the main purpose of email verification in a Flask application?

easy

A. To store user data securely in the database

B. To confirm that the user owns the provided email address

C. To speed up the login process

D. To encrypt the user's password

Solution

1. Step 1: Understand email verification purpose

   Email verification is used to confirm that the user actually owns the email they provided during signup.

2. Step 2: Differentiate from other security tasks

   Encrypting passwords and speeding login are different tasks unrelated to email verification.

3. Final Answer:

   To confirm that the user owns the provided email address -> Option B

4. Quick Check:

   Email verification = Confirm ownership [OK]

Hint: Email verification confirms user email ownership [OK]

Common Mistakes:

• Confusing email verification with password encryption
• Thinking it speeds up login
• Assuming it stores data securely

2. Which Flask library is commonly used to create timed tokens for email verification?

easy

A. flask_sqlalchemy

B. flask_login

C. itsdangerous

D. flask_mail

Solution

1. Step 1: Identify token generation library

   The itsdangerous library provides URLSafeTimedSerializer to create timed tokens.

2. Step 2: Differentiate from other Flask extensions

   flask_sqlalchemy manages databases, flask_login handles user sessions, and flask_mail sends emails but does not create tokens.

3. Final Answer:

   itsdangerous -> Option C

4. Quick Check:

   Token creation = itsdangerous [OK]

Hint: Use itsdangerous for timed token creation [OK]

Common Mistakes:

• Choosing flask_mail for token creation
• Confusing flask_login with token generation
• Selecting flask_sqlalchemy incorrectly

3. Given this Flask code snippet, what will verify_token(token) return if the token is expired?

from itsdangerous import URLSafeTimedSerializer, SignatureExpired

serializer = URLSafeTimedSerializer('secret-key')

def verify_token(token):
    try:
        email = serializer.loads(token, max_age=3600)
        return email
    except SignatureExpired:
        return None

medium

A. Returns None

B. Raises a SignatureExpired exception

C. The email string inside the token

D. Returns an empty string

Solution

1. Step 1: Understand token verification logic

   The function tries to load the token with a max age of 3600 seconds (1 hour).

2. Step 2: Handle expired token exception

   If the token is expired, it raises SignatureExpired, which is caught and returns None.

3. Final Answer:

   Returns None -> Option A

4. Quick Check:

   Expired token returns None [OK]

Hint: Expired tokens return None in try-except block [OK]

Common Mistakes:

• Expecting exception to propagate
• Assuming it returns empty string
• Thinking it returns the email anyway

4. Identify the error in this Flask email verification token generation code:

from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer('secret-key')

def generate_token(email):
    token = serializer.dumps(email)
    return token

# Later verification
email = serializer.loads(token, max_age=3600)

medium

A. Token variable is undefined at verification

B. Missing secret key in serializer initialization

C. max_age parameter is invalid in loads()

D. Using dumps() instead of loads() to verify

Solution

1. Step 1: Check token generation and usage

   The token is generated inside generate_token but not stored or passed outside.

2. Step 2: Verify token usage scope

   At verification, token is used but not defined in that scope, causing a NameError.

3. Final Answer:

   Token variable is undefined at verification -> Option A

4. Quick Check:

   Undefined token variable causes error [OK]

Hint: Ensure token variable is defined before verification [OK]

Common Mistakes:

• Ignoring variable scope for token
• Thinking secret key is missing
• Misusing max_age parameter

5. You want to implement email verification in Flask so that users receive a link with a token that expires after 24 hours. Which approach correctly combines token creation, sending email, and verification?

hard

A. Generate token without secret key, send email, verify token ignoring expiration

B. Store plain email in database, send email without token, verify by matching email only

C. Send token as plain text in email body, verify token with max_age=3600

D. Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400

Solution

1. Step 1: Create token with expiration

   Use URLSafeTimedSerializer with a secret key to generate a token that expires after 86400 seconds (24 hours).

2. Step 2: Send email with token link and verify properly

   Send the token inside a URL link in the email. Verify the token using loads() with max_age=86400 to enforce expiration.

3. Final Answer:

   Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400 -> Option D

4. Quick Check:

   Token creation + email + 24h expiry = Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400 [OK]

Hint: Use max_age=86400 for 24h token expiry [OK]

Common Mistakes:

• Not using tokens in email links
• Ignoring token expiration
• Sending tokens without secret key