Login_required decorator in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user accesses a protected route without login?

Consider a Flask route decorated with @login_required. What is the typical behavior if a user tries to access this route without being logged in?

Flask

from flask import Flask, redirect, url_for
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return redirect(url_for('login'))

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard!'

@app.route('/login')
def login():
    return 'Please log in.'

A The user is shown a blank page with no message.

B The user sees the dashboard content anyway.

C The user is redirected to the login page.

D The server returns a 500 Internal Server Error.

💡 Hint

Think about what the unauthorized_handler does in Flask-Login.

The @login_required decorator checks if the user is logged in. If not, Flask-Login calls the unauthorized_handler, which usually redirects the user to the login page.

📝 Syntax

intermediate

Identify the correct way to apply the login_required decorator

Which of the following Flask route definitions correctly applies the @login_required decorator?

A

@app.route('/profile')
def profile():
    return login_required('User Profile')

B

@app.route('/profile')
@login_required
def profile():
    return 'User Profile'

C

@app.route('/profile')
def profile():
@login_required
    return 'User Profile'

D

@login_required
@app.route('/profile')
def profile():
    return 'User Profile'

💡 Hint

Remember the order of decorators matters in Flask routes.

The @login_required decorator must be placed directly above the route function, after the @app.route decorator. Option B shows the correct order.

❓ state_output

advanced

What is the value of current_user.is_authenticated inside a login_required route?

Inside a Flask route decorated with @login_required, what will current_user.is_authenticated return?

Flask

from flask_login import current_user, login_required

@app.route('/settings')
@login_required
def settings():
    return str(current_user.is_authenticated)

A True

B False

C None

D Raises an AttributeError

💡 Hint

The decorator only allows access if the user is logged in.

The @login_required decorator ensures the user is logged in before running the route. Therefore, current_user.is_authenticated will always be True inside that route.

🔧 Debug

advanced

Why does this login_required route cause a redirect loop?

Given this Flask code, why does accessing /profile cause a redirect loop?

Flask

from flask import Flask, redirect, url_for
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return redirect(url_for('profile'))

@app.route('/profile')
@login_required
def profile():
    return 'User Profile'

A The login_required decorator is missing on the profile route.

B The unauthorized handler should return a 404 error instead of redirect.

C The Flask app is missing a secret key, causing session errors.

D The unauthorized handler redirects to the same protected route, causing infinite redirects.

💡 Hint

Check where the unauthorized handler sends users who are not logged in.

The unauthorized handler redirects to /profile, which is protected by @login_required. Since the user is not logged in, this causes a redirect loop.

🧠 Conceptual

expert

How does the login_required decorator integrate with Flask's request lifecycle?

Which statement best describes how the @login_required decorator works within Flask's request handling process?

A It intercepts the request before the route function runs and checks user authentication, redirecting if needed.

B It modifies the response after the route function runs to add authentication headers.

C It replaces the route function with a login form rendering function unconditionally.

D It runs only after the response is sent to the client to log user activity.

💡 Hint

Think about when decorators run in relation to the route function.

The @login_required decorator wraps the route function. It checks if the user is authenticated before the route runs. If not, it redirects the user, preventing the route function from executing.

Practice

1. What is the main purpose of the @login_required decorator in Flask?

easy

A. To automatically log out users after a timeout

B. To restrict access to a view so only logged-in users can see it

C. To register a new user in the database

D. To display a welcome message on the homepage

Solution

1. Step 1: Understand the role of @login_required

   This decorator is used to protect routes so only authenticated users can access them.

2. Step 2: Identify what it does in Flask-Login

   If a user is not logged in, it redirects them to the login page instead of showing the protected content.

3. Final Answer:

   To restrict access to a view so only logged-in users can see it -> Option B

4. Quick Check:

   Access control = Restrict to logged-in users [OK]

Hint: Think: Who should see this page? Only logged-in users! [OK]

Common Mistakes:

• Confusing login_required with user registration
• Thinking it logs out users automatically
• Assuming it shows messages instead of restricting access

2. Which of the following is the correct way to use the @login_required decorator in a Flask view function?

easy

A. def @login_required my_view(): pass

B. def my_view() @login_required: pass

C. @login_required
def my_view(): pass

D. my_view = login_required(def my_view()): pass

Solution

1. Step 1: Recall Python decorator syntax

   Decorators are placed on the line above the function with an @ symbol, then the function is defined normally.

2. Step 2: Match correct syntax for @login_required

   @login_required def my_view(): pass correctly places @login_required above the function definition.

3. Final Answer:

   @login_required\ndef my_view(): pass -> Option C

4. Quick Check:

   Decorator above function = @login_required def my_view(): pass [OK]

Hint: Decorator always goes on the line before the function [OK]

Common Mistakes:

• Placing @login_required inside the function signature
• Trying to use @login_required after function definition
• Using invalid Python syntax for decorators

3. Given this Flask route with @login_required:

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard'

What happens if a user who is NOT logged in tries to visit /dashboard?

medium

A. They are redirected to the login page

B. They get a 404 Not Found error

C. They see the message 'Welcome to your dashboard'

D. The server crashes with an error

Solution

1. Step 1: Understand @login_required behavior

   This decorator checks if the user is authenticated before allowing access.

2. Step 2: What happens if user is not logged in?

   The decorator redirects unauthenticated users to the login page automatically.

3. Final Answer:

   They are redirected to the login page -> Option A

4. Quick Check:

   Not logged in = redirect to login [OK]

Hint: Not logged in? Redirect to login page! [OK]

Common Mistakes:

• Thinking the page content shows anyway
• Assuming a 404 error occurs
• Believing the server crashes

4. Consider this Flask code snippet:

from flask_login import login_required

@app.route('/profile')
def profile():
    return 'User Profile'

Why will this code NOT restrict access to logged-in users?

medium

A. Because the function name must be login_required

B. Because login_required must be imported from flask, not flask_login

C. Because the route decorator must come after @login_required

D. Because @login_required is missing above the profile function

Solution

1. Step 1: Check if @login_required is applied

   The function profile lacks the @login_required decorator above it.

2. Step 2: Understand decorator order and import

   Import from flask_login is correct, and route decorator order is flexible, but missing @login_required means no access restriction.

3. Final Answer:

   Because @login_required is missing above the profile function -> Option D

4. Quick Check:

   Missing decorator = no restriction [OK]

Hint: Decorator must be above function to restrict access [OK]

Common Mistakes:

• Thinking import location causes the issue
• Believing decorator order is wrong
• Assuming function name affects access control

5. You want to protect multiple routes in your Flask app so only logged-in users can access them. Which approach correctly protects these routes without repeating the @login_required decorator on each function? A) Use a custom decorator that wraps @login_required and apply it to each function B) Apply @login_required once on the Flask app object C) Add @login_required only to the first route function and it applies to all others D) Use Flask's before_request to check login status and redirect if needed

hard

A. Use Flask's before_request to check login status and redirect if needed

B. Apply @login_required once on the Flask app object

C. Add @login_required only to the first route function and it applies to all others

D. Use a custom decorator that wraps @login_required and apply it to each function

Solution

1. Step 1: Understand how to protect multiple routes efficiently

   Applying @login_required individually works but is repetitive.

2. Step 2: Use before_request to check login once for all routes

   Flask's before_request runs before every request, so you can check if the user is logged in and redirect if not, protecting multiple routes centrally.

3. Step 3: Evaluate other options

   Use a custom decorator that wraps @login_required and apply it to each function still requires decorating each function. Apply @login_required once on the Flask app object is invalid because @login_required is not applied to the app object. Add @login_required only to the first route function and it applies to all others is incorrect because decorators do not cascade to other functions.

4. Final Answer:

   Use Flask's before_request to check login status and redirect if needed -> Option A

5. Quick Check:

   Central login check = before_request [OK]

Hint: Use before_request for one check on all routes [OK]

Common Mistakes:

• Thinking one decorator on app protects all routes
• Assuming decorators cascade automatically
• Not knowing about before_request hook