Permission checking in routes in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without permission accesses this Flask route?

Consider this Flask route that checks user permissions before allowing access:

from flask import Flask, abort
app = Flask(__name__)

@app.route('/admin')
def admin_panel():
    user = get_current_user()
    if not user.has_permission('admin'):
        abort(403)
    return 'Welcome to admin panel'

What will the user see if they do not have the 'admin' permission?

Flask

from flask import Flask, abort
app = Flask(__name__)

@app.route('/admin')
def admin_panel():
    user = get_current_user()
    if not user.has_permission('admin'):
        abort(403)
    return 'Welcome to admin panel'

A The server crashes with an exception.

B The user sees a 403 Forbidden error page.

C The user is redirected to the login page.

D The user sees the message 'Welcome to admin panel'.

💡 Hint

Think about what abort(403) does in Flask.

The abort(403) function immediately stops the request and returns a 403 Forbidden HTTP error to the user. This means the user will see a 403 error page if they lack the required permission.

📝 Syntax

intermediate

Identify the syntax error in this Flask permission check

Look at this Flask route code snippet:

@app.route('/dashboard')
def dashboard():
    user = get_current_user()
    if user.has_permission('view_dashboard')
        return 'Dashboard content'
    else:
        abort(403)

What is the syntax error here?

Flask

@app.route('/dashboard')
def dashboard():
    user = get_current_user()
    if user.has_permission('view_dashboard')
        return 'Dashboard content'
    else:
        abort(403)

A Missing colon ':' after the if condition.

B Missing parentheses in abort call.

C Indentation error in the else block.

D Route decorator is missing parentheses.

💡 Hint

Check the syntax of the if statement line.

In Python, an if statement must end with a colon ':'. The line if user.has_permission('view_dashboard') is missing this colon, causing a syntax error.

❓ state_output

advanced

What is the response status code when permission check passes?

Given this Flask route:

@app.route('/settings')
def settings():
    user = get_current_user()
    if user.has_permission('edit_settings'):
        return 'Settings page', 200
    else:
        abort(403)

What HTTP status code will the client receive if the user has the 'edit_settings' permission?

Flask

@app.route('/settings')
def settings():
    user = get_current_user()
    if user.has_permission('edit_settings'):
        return 'Settings page', 200
    else:
        abort(403)

A 500

B 404

C 403

D 200

💡 Hint

Look at the return statement when permission is granted.

The route returns the string 'Settings page' with status code 200 when the user has permission. So the client receives HTTP 200 OK.

🔧 Debug

advanced

Why does this permission check always allow access?

Examine this Flask route:

@app.route('/profile')
def profile():
    user = get_current_user()
    if user.has_permission('view_profile') == False:
        return 'Access denied', 403
    return 'User profile'

Users report they can access the profile page even without permission. Why?

Flask

@app.route('/profile')
def profile():
    user = get_current_user()
    if user.has_permission('view_profile') == False:
        return 'Access denied', 403
    return 'User profile'

A The permission check uses '== False' which may fail if has_permission returns None or other falsy values.

B The function get_current_user() is not defined, so user is None.

C The route decorator is missing parentheses.

D The return statement for access denied is missing abort() call.

💡 Hint

Consider how Python evaluates boolean expressions and the return value of has_permission.

If has_permission returns a falsy value other than exactly False (like None), the condition user.has_permission('view_profile') == False will be False, allowing access incorrectly. It's safer to use if not user.has_permission(...).

🧠 Conceptual

expert

Which approach best secures multiple routes with the same permission check?

You want to protect several Flask routes so only users with 'editor' permission can access them. Which approach is best to avoid repeating permission checks in every route?

A Check permissions only in the first route and assume users have permission for others.

B Manually add the permission check code inside each route function.

C Create a custom decorator that checks 'editor' permission and apply it to all relevant routes.

D Use a global before_request function that aborts if the user lacks 'editor' permission for all routes.

💡 Hint

Think about code reuse and clear permission enforcement per route.

A custom decorator lets you write the permission check once and reuse it on any route needing that permission. This keeps code clean and consistent. Using before_request globally may block unrelated routes. Manual checks cause repetition. Assuming permissions is insecure.

Practice

1. What is the main purpose of permission checking in Flask routes?

easy

A. To change the URL of the route dynamically

B. To speed up the server response time

C. To control who can access certain parts of the web app

D. To style the webpage with CSS

Solution

1. Step 1: Understand the role of permission checking

   Permission checking is used to decide if a user is allowed to see or use a route.

2. Step 2: Identify the correct purpose among options

   Only controlling access matches the purpose; others are unrelated to permissions.

3. Final Answer:

   To control who can access certain parts of the web app -> Option C

4. Quick Check:

   Permission checking = control access [OK]

Hint: Permission checking controls access to routes [OK]

Common Mistakes:

• Confusing permission checking with styling or URL changes
• Thinking it improves speed
• Mixing permission with routing logic

2. Which Flask function is used to stop a request with a 403 Forbidden error when permission is denied?

easy

A. abort(403)

B. url_for()

C. render_template()

D. redirect()

Solution

1. Step 1: Recall Flask error handling functions

   Flask's abort() function stops a request and returns an HTTP error code.

2. Step 2: Match the error code for permission denied

   403 is the standard HTTP code for Forbidden access, so abort(403) is correct.

3. Final Answer:

   abort(403) -> Option A

4. Quick Check:

   403 error = abort(403) [OK]

Hint: Use abort(403) to block unauthorized access [OK]

Common Mistakes:

• Using redirect() instead of abort() for permission errors
• Confusing abort() with render_template()
• Using url_for() which only builds URLs

3. Given this Flask route code:

from flask import abort, Flask, request
app = Flask(__name__)

@app.route('/admin')
def admin_panel():
    if not (request.args.get('is_admin') == 'true'):
        abort(403)
    return 'Welcome Admin'

What happens if you visit /admin?is_admin=false?

medium

A. The page shows 'Welcome Admin'

B. The server returns a 403 Forbidden error

C. The server crashes with an error

D. The page redirects to another route

Solution

1. Step 1: Analyze the permission check condition

   The code checks if the query parameter 'is_admin' equals 'true'. If not, it aborts with 403.

2. Step 2: Evaluate the given URL parameter

   The URL has 'is_admin=false', which is not 'true', so abort(403) runs.

3. Final Answer:

   The server returns a 403 Forbidden error -> Option B

4. Quick Check:

   is_admin != 'true' triggers abort(403) [OK]

Hint: Check query param; if not 'true', abort(403) triggers [OK]

Common Mistakes:

• Assuming any value other than missing is allowed
• Thinking the page shows the welcome message anyway
• Expecting a redirect instead of abort

4. Identify the error in this Flask route permission check:

from flask import abort, Flask
app = Flask(__name__)

@app.route('/secret')
def secret():
    if user.is_admin == False:
        abort(403)
    return 'Secret Data'

medium

A. user variable is not defined in the route

B. Incorrect use of abort function

C. Missing import of user object

D. Route decorator syntax is wrong

Solution

1. Step 1: Check variable usage inside the route

   The code uses user.is_admin but user is not defined or passed in the function.

2. Step 2: Confirm other parts are correct

   abort is used correctly, and the route decorator syntax is fine.

3. Final Answer:

   user variable is not defined in the route -> Option A

4. Quick Check:

   Undefined user variable causes error [OK]

Hint: Ensure variables used in routes are defined or passed [OK]

Common Mistakes:

• Assuming user is globally available without definition
• Misusing abort syntax
• Thinking route decorator is incorrect

5. You want to create a helper function check_permission() that aborts with 403 if the user is not an admin. Which of these is the best way to use it in a Flask route?

hard

A. Call check_permission() after returning the response

B. Replace the route function with check_permission() entirely

C. Use check_permission() only in templates, not routes

D. Call check_permission() inside the route before returning content

Solution

1. Step 1: Understand when permission checks should run

   Permission checks must happen before sending the response to block unauthorized access early.

2. Step 2: Evaluate the options for calling the helper

   Calling it inside the route before returning content ensures unauthorized users are stopped properly.

3. Final Answer:

   Call check_permission() inside the route before returning content -> Option D

4. Quick Check:

   Check permissions before response [OK]

Hint: Check permissions before returning response [OK]

Common Mistakes:

• Calling permission check after response is sent
• Trying to check permissions in templates
• Replacing route with permission check function