Login form and verification in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user submits the login form with correct credentials?

Consider a Flask login form that checks username and password against stored values. What is the typical behavior after a successful login?

Flask

from flask import Flask, request, redirect, url_for, render_template_string
app = Flask(__name__)

users = {'alice': 'wonderland'}

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        if username in users and users[username] == password:
            return redirect(url_for('dashboard'))
        else:
            return 'Login Failed', 401
    return render_template_string('''<form method='post'>
        <input name='username'>
        <input name='password' type='password'>
        <input type='submit'>
    </form>''')

@app.route('/dashboard')
def dashboard():
    return 'Welcome!'

if __name__ == '__main__':
    app.run()

A The user is redirected to the dashboard page with a welcome message.

B The login form reloads with an error message about invalid credentials.

C The server returns a 404 Not Found error.

D The user sees the login form again without any message.

💡 Hint

Think about what redirect(url_for('dashboard')) does after a successful login.

When the username and password match, the code redirects the user to the dashboard route, which shows a welcome message.

📝 Syntax

intermediate

Identify the syntax error in this Flask login route

Which option correctly fixes the syntax error in this Flask login route code?

Flask

from flask import Flask, request
app = Flask(__name__)

users = {'alice': 'wonderland'}

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    if username in users and users[username] == password
        return 'Logged in'
    else:
        return 'Failed'

if __name__ == '__main__':
    app.run()

A Change 'request.form' to 'request.forms'.

B Indent the return statements one level less.

C Add a colon ':' at the end of the if statement line.

D Remove the else block entirely.

💡 Hint

Python requires a colon at the end of control statements like if.

The if statement is missing a colon at the end, causing a syntax error. Adding ':' fixes it.

❓ state_output

advanced

What is the output after submitting invalid credentials?

Given this Flask login snippet, what response does the server send when the password is wrong?

Flask

from flask import Flask, request
app = Flask(__name__)

users = {'bob': 'builder'}

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    if username in users and users[username] == password:
        return 'Success'
    else:
        return 'Unauthorized', 401

if __name__ == '__main__':
    app.run()

A A redirect to the login page

B 'Unauthorized' with HTTP status code 401

C 'Success' with HTTP status code 200

D A server error 500

💡 Hint

Look at the else block's return statement and its status code.

If the password is wrong, the server returns the string 'Unauthorized' with status code 401, indicating access denied.

🔧 Debug

advanced

Why does this Flask login form always fail to authenticate?

Examine the code below. Why does the login always fail even with correct credentials?

Flask

from flask import Flask, request
app = Flask(__name__)

users = {'eve': 'secret'}

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    if username == users.get(username) and password == users.get(username):
        return 'Logged in'
    else:
        return 'Failed'

if __name__ == '__main__':
    app.run()

A The route does not accept POST requests.

B The form data keys are incorrect; should use 'user' and 'pass'.

C The users dictionary is empty, so no match is possible.

D The condition compares username to password instead of checking password correctness.

💡 Hint

Look carefully at the if condition comparing username and password.

The condition wrongly compares username to users.get(username) (which returns the password), so username == password is checked, which fails. It should check password == users.get(username).

🧠 Conceptual

expert

What is the main security risk of this simple Flask login implementation?

Consider a Flask login system that stores passwords in plain text in a dictionary and checks them directly. What is the biggest security risk?

Flask

users = {'admin': '12345'}

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    if username in users and users[username] == password:
        return 'Welcome'
    else:
        return 'Denied', 401

A Passwords are stored in plain text, risking exposure if the code or data leaks.

B The login form uses POST instead of GET, which is insecure.

C The code does not use HTTPS, causing syntax errors.

D The username is not validated for length, causing runtime errors.

💡 Hint

Think about how passwords should be stored securely.

Storing passwords in plain text is dangerous because if anyone accesses the data, they see all passwords. Passwords should be hashed and salted.