Password reset email pattern in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this Flask route do when a password reset is requested?

Consider this Flask route for password reset requests. What is the main behavior when a user submits their email?

Flask

from flask import Flask, request, render_template_string
app = Flask(__name__)

@app.route('/reset-password', methods=['GET', 'POST'])
def reset_password():
    if request.method == 'POST':
        email = request.form.get('email')
        if email and '@' in email:
            # Simulate sending reset email
            return 'Reset email sent to ' + email
        else:
            return 'Invalid email', 400
    return render_template_string('<form method="post"><input name="email" type="email"/><button>Send</button></form>')

A It sends a reset email if the email contains '@', otherwise returns a 400 error.

B It always sends a reset email regardless of the email format.

C It only accepts GET requests and ignores POST.

D It returns a 404 error if the method is GET.

💡 Hint

Look at the condition that checks the email format and the HTTP method.

The route checks if the request method is POST and if the email contains '@'. If both are true, it simulates sending a reset email. Otherwise, it returns a 400 error for invalid email. For GET requests, it shows a simple form.

📝 Syntax

intermediate

Which option correctly generates a secure token for password reset?

Which code snippet correctly generates a secure token for a password reset link in Flask?

Flask

import secrets

def generate_token():
    # Fill in the correct token generation
    pass

A return secrets.choice(['a','b','c','d'])

B return secrets.randbelow(1000000)

C return secrets.token_hex(4)

D return secrets.token_urlsafe(32)

💡 Hint

Look for a method that returns a URL-safe string with enough randomness.

secrets.token_urlsafe(32) generates a secure random URL-safe string of 32 bytes, ideal for tokens. randbelow returns an integer, token_hex(4) is shorter and less secure, choice picks a single character.

🔧 Debug

advanced

Why does this password reset email sending code fail to send emails?

Review this Flask snippet for sending password reset emails. Why does it fail to send emails?

Flask

from flask_mail import Mail, Message

app.config.update(
    MAIL_SERVER='smtp.example.com',
    MAIL_PORT=587,
    MAIL_USE_TLS=True,
    MAIL_USERNAME='[e-mail]',
    MAIL_PASSWORD='password'
)
mail = Mail(app)

def send_reset_email(user_email, token):
    msg = Message('Reset Your Password', sender='[e-mail]', recipients=[user_email])
    msg.body = f'Click to reset: http://example.com/reset/{token}'
    mail.send(msg)

A The mail.send() method is missing app context, causing failure.

B MAIL_USE_TLS should be False for port 587.

C The sender email must match MAIL_USERNAME exactly.

D The Mail object is created before app is fully initialized, causing failure.

💡 Hint

Flask-Mail requires app context when sending emails outside request handlers.

mail.send() needs to run inside Flask's application context. Without it, sending fails silently or raises errors. Wrapping send_reset_email calls with app.app_context() fixes this.

❓ state_output

advanced

What is the output of this Flask password reset token verification code?

Given this token verification function, what is the output when token='abc123' and stored_tokens={'abc123': 'user1'}?

Flask

stored_tokens = {'abc123': 'user1'}

def verify_token(token):
    user = stored_tokens.get(token)
    if user:
        return f'Token valid for {user}'
    else:
        return 'Invalid token'

result = verify_token('abc123')

A None

B "Invalid token"

C "Token valid for user1"

D KeyError

💡 Hint

Check what stored_tokens.get(token) returns when token exists.

stored_tokens.get('abc123') returns 'user1', so the function returns 'Token valid for user1'.

🧠 Conceptual

expert

Which option best describes the security risk of using predictable tokens in password reset emails?

Why is it dangerous to use predictable tokens (like incremental numbers) in password reset links?

A Predictable tokens improve performance but reduce email deliverability.

B Attackers can guess tokens and reset passwords of other users easily.

C They cause the reset link to expire too quickly, annoying users.

D Using predictable tokens requires more server memory to store.

💡 Hint

Think about what happens if someone can guess the token in a reset link.

Predictable tokens allow attackers to guess valid reset links and hijack accounts by resetting passwords without permission.