Login_required decorator in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user accesses a protected route without login?

Consider a Flask route decorated with @login_required. What is the typical behavior if a user tries to access this route without being logged in?

Flask

from flask import Flask, redirect, url_for
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return redirect(url_for('login'))

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard!'

@app.route('/login')
def login():
    return 'Please log in.'

A The user is shown a blank page with no message.

B The user sees the dashboard content anyway.

C The user is redirected to the login page.

D The server returns a 500 Internal Server Error.

💡 Hint

Think about what the unauthorized_handler does in Flask-Login.

The @login_required decorator checks if the user is logged in. If not, Flask-Login calls the unauthorized_handler, which usually redirects the user to the login page.

📝 Syntax

intermediate

Identify the correct way to apply the login_required decorator

Which of the following Flask route definitions correctly applies the @login_required decorator?

A

@app.route('/profile')
def profile():
    return login_required('User Profile')

B

@app.route('/profile')
@login_required
def profile():
    return 'User Profile'

C

@app.route('/profile')
def profile():
@login_required
    return 'User Profile'

D

@login_required
@app.route('/profile')
def profile():
    return 'User Profile'

💡 Hint

Remember the order of decorators matters in Flask routes.

The @login_required decorator must be placed directly above the route function, after the @app.route decorator. Option B shows the correct order.

❓ state_output

advanced

What is the value of current_user.is_authenticated inside a login_required route?

Inside a Flask route decorated with @login_required, what will current_user.is_authenticated return?

Flask

from flask_login import current_user, login_required

@app.route('/settings')
@login_required
def settings():
    return str(current_user.is_authenticated)

A True

B False

C None

D Raises an AttributeError

💡 Hint

The decorator only allows access if the user is logged in.

The @login_required decorator ensures the user is logged in before running the route. Therefore, current_user.is_authenticated will always be True inside that route.

🔧 Debug

advanced

Why does this login_required route cause a redirect loop?

Given this Flask code, why does accessing /profile cause a redirect loop?

Flask

from flask import Flask, redirect, url_for
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return redirect(url_for('profile'))

@app.route('/profile')
@login_required
def profile():
    return 'User Profile'

A The login_required decorator is missing on the profile route.

B The unauthorized handler should return a 404 error instead of redirect.

C The Flask app is missing a secret key, causing session errors.

D The unauthorized handler redirects to the same protected route, causing infinite redirects.

💡 Hint

Check where the unauthorized handler sends users who are not logged in.

The unauthorized handler redirects to /profile, which is protected by @login_required. Since the user is not logged in, this causes a redirect loop.

🧠 Conceptual

expert

How does the login_required decorator integrate with Flask's request lifecycle?

Which statement best describes how the @login_required decorator works within Flask's request handling process?

A It intercepts the request before the route function runs and checks user authentication, redirecting if needed.

B It modifies the response after the route function runs to add authentication headers.

C It replaces the route function with a login form rendering function unconditionally.

D It runs only after the response is sent to the client to log user activity.

💡 Hint

Think about when decorators run in relation to the route function.

The @login_required decorator wraps the route function. It checks if the user is authenticated before the route runs. If not, it redirects the user, preventing the route function from executing.