Flask-Login extension - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user accesses a @login_required route without being logged in?

Consider a Flask app using Flask-Login with a route decorated by @login_required. What is the behavior when an anonymous user tries to access this route?

Flask

from flask import Flask
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return 'Redirected to login', 302

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard!'

A The user is redirected to the login page or unauthorized handler is called.

B The server crashes with an exception.

C The server returns a 404 Not Found error.

D The user sees the dashboard content without logging in.

💡 Hint

Think about what @login_required does when the user is not authenticated.

The @login_required decorator checks if the user is logged in. If not, it triggers the unauthorized handler, which usually redirects to the login page.

❓ state_output

intermediate

What is the value of current_user.is_authenticated after login?

After a user successfully logs in using Flask-Login's login_user(user) function, what is the value of current_user.is_authenticated?

Flask

from flask_login import current_user, login_user

# Assume user is a valid User object
login_user(user)

value = current_user.is_authenticated

A True

B False

C None

D Raises an AttributeError

💡 Hint

Check what current_user.is_authenticated means after login.

After login_user(user) is called, current_user represents the logged-in user, so is_authenticated is True.

📝 Syntax

advanced

Which code snippet correctly sets up user_loader for Flask-Login?

You want to tell Flask-Login how to load a user from a user ID stored in the session. Which snippet correctly implements the user_loader callback?

A

@login_manager.user_loader
def load_user(user_id):
    return User.get(user_id)

B

@login_manager.user_loader
def load_user(user_id):
    return User.load(user_id)

C

@login_manager.user_loader
def load_user(user_id):
    return User.find_by_id(user_id)

D

@login_manager.user_loader
def load_user(user_id):
    return User.query.get(int(user_id))

💡 Hint

Flask-Login expects a function that returns a user object or None given a user ID string.

The user_loader function must accept a user ID string and return the user object. Using User.query.get(int(user_id)) is the standard pattern with SQLAlchemy.

🔧 Debug

advanced

Why does current_user always appear anonymous even after login?

You call login_user(user) successfully, but in your routes current_user.is_authenticated is always False. What is the most likely cause?

Flask

from flask import Flask
from flask_login import LoginManager, login_user, current_user

app = Flask(__name__)
login_manager = LoginManager(app)

@app.route('/login')
def login():
    user = User.query.first()
    login_user(user)
    return 'Logged in'

@app.route('/profile')
def profile():
    if current_user.is_authenticated:
        return 'User profile'
    else:
        return 'Anonymous user'

A The Flask app is missing a secret key for session management.

B The user object passed to login_user is None.

C The @login_manager.user_loader function is not defined.

D The login_user function is called outside a request context.

💡 Hint

Flask-Login requires a user_loader callback to retrieve the user from the session ID.

The @login_manager.user_loader function is not defined. Without it, even if the user ID is stored in the session, Flask-Login cannot load the actual user object and defaults to an anonymous user on subsequent requests.

🧠 Conceptual

expert

What is the purpose of the @login_manager.unauthorized_handler decorator?

In Flask-Login, what does the function decorated with @login_manager.unauthorized_handler do?

A It logs out the current user when unauthorized access is detected.

B It defines the response when a user tries to access a protected route without being logged in.

C It automatically redirects logged-in users to the home page.

D It initializes the login manager with the Flask app.

💡 Hint

Think about what happens when @login_required denies access.

The unauthorized_handler function is called when a user tries to access a login_required route but is not authenticated. It usually redirects or returns an error.