Permission checking in routes in Flask - Mini Project: Build & Apply

Permission checking in routes

📖 Scenario: You are building a simple web app using Flask. Some pages should only be accessible to users with certain permissions. You want to check these permissions inside your route functions to keep your app secure.

🎯 Goal: Create a Flask app with a dictionary of users and their permissions. Then add a route that checks if the current user has permission before showing the page.

📋 What You'll Learn

Create a dictionary called users with usernames as keys and permission lists as values

Create a variable called current_user to represent the logged-in user

Write a route function /dashboard that checks if current_user has the 'view_dashboard' permission

Return a message 'Access granted to dashboard' if permission is present, otherwise 'Access denied'

💡 Why This Matters

🌍 Real World

Permission checks in routes are essential for web apps to control who can see or do what. This keeps user data safe and the app secure.

💼 Career

Backend developers often write permission checks in routes to enforce security rules. Understanding this helps you build secure web applications.

1

Create users dictionary

Create a dictionary called users with these exact entries: 'alice': ['view_dashboard', 'edit_profile'], 'bob': ['edit_profile'], and 'carol': ['view_dashboard'].

Flask

# Create the users dictionary with exact entries
# Your code here

Hint

Use curly braces {} to create the dictionary. Each key is a username string, and each value is a list of permission strings.

2

Set current user

Create a variable called current_user and set it to the string 'alice' to represent the logged-in user.

Flask

users = {
    'alice': ['view_dashboard', 'edit_profile'],
    'bob': ['edit_profile'],
    'carol': ['view_dashboard']
}

# Set the current_user variable
# Your code here

Hint

Just assign the string 'alice' to the variable current_user.

3

Create dashboard route with permission check

Import Flask and request from flask. Create a Flask app called app. Then write a route function for /dashboard that checks if 'view_dashboard' is in users[current_user]. If yes, return 'Access granted to dashboard'. Otherwise, return 'Access denied'.

Flask

users = {
    'alice': ['view_dashboard', 'edit_profile'],
    'bob': ['edit_profile'],
    'carol': ['view_dashboard']
}

current_user = 'alice'

# Import Flask and create app
# Write /dashboard route with permission check
# Your code here

Hint

Use @app.route('/dashboard') to create the route. Inside the function, check if 'view_dashboard' is in the list of permissions for current_user.

4

Run the Flask app

Add the code to run the Flask app only if this file is the main program. Use app.run(debug=True) inside the if __name__ == '__main__': block.

Flask

from flask import Flask, request

users = {
    'alice': ['view_dashboard', 'edit_profile'],
    'bob': ['edit_profile'],
    'carol': ['view_dashboard']
}

current_user = 'alice'

app = Flask(__name__)

@app.route('/dashboard')
def dashboard():
    if 'view_dashboard' in users[current_user]:
        return 'Access granted to dashboard'
    else:
        return 'Access denied'

# Add code to run the app
# Your code here

Hint

This code makes sure the Flask app runs only when you run this file directly.

Practice

1. What is the main purpose of permission checking in Flask routes?

easy

A. To change the URL of the route dynamically

B. To speed up the server response time

C. To control who can access certain parts of the web app

D. To style the webpage with CSS

Solution

1. Step 1: Understand the role of permission checking

   Permission checking is used to decide if a user is allowed to see or use a route.

2. Step 2: Identify the correct purpose among options

   Only controlling access matches the purpose; others are unrelated to permissions.

3. Final Answer:

   To control who can access certain parts of the web app -> Option C

4. Quick Check:

   Permission checking = control access [OK]

Hint: Permission checking controls access to routes [OK]

Common Mistakes:

• Confusing permission checking with styling or URL changes
• Thinking it improves speed
• Mixing permission with routing logic

2. Which Flask function is used to stop a request with a 403 Forbidden error when permission is denied?

easy

A. abort(403)

B. url_for()

C. render_template()

D. redirect()

Solution

1. Step 1: Recall Flask error handling functions

   Flask's abort() function stops a request and returns an HTTP error code.

2. Step 2: Match the error code for permission denied

   403 is the standard HTTP code for Forbidden access, so abort(403) is correct.

3. Final Answer:

   abort(403) -> Option A

4. Quick Check:

   403 error = abort(403) [OK]

Hint: Use abort(403) to block unauthorized access [OK]

Common Mistakes:

• Using redirect() instead of abort() for permission errors
• Confusing abort() with render_template()
• Using url_for() which only builds URLs

3. Given this Flask route code:

from flask import abort, Flask, request
app = Flask(__name__)

@app.route('/admin')
def admin_panel():
    if not (request.args.get('is_admin') == 'true'):
        abort(403)
    return 'Welcome Admin'

What happens if you visit /admin?is_admin=false?

medium

A. The page shows 'Welcome Admin'

B. The server returns a 403 Forbidden error

C. The server crashes with an error

D. The page redirects to another route

Solution

1. Step 1: Analyze the permission check condition

   The code checks if the query parameter 'is_admin' equals 'true'. If not, it aborts with 403.

2. Step 2: Evaluate the given URL parameter

   The URL has 'is_admin=false', which is not 'true', so abort(403) runs.

3. Final Answer:

   The server returns a 403 Forbidden error -> Option B

4. Quick Check:

   is_admin != 'true' triggers abort(403) [OK]

Hint: Check query param; if not 'true', abort(403) triggers [OK]

Common Mistakes:

• Assuming any value other than missing is allowed
• Thinking the page shows the welcome message anyway
• Expecting a redirect instead of abort

4. Identify the error in this Flask route permission check:

from flask import abort, Flask
app = Flask(__name__)

@app.route('/secret')
def secret():
    if user.is_admin == False:
        abort(403)
    return 'Secret Data'

medium

A. user variable is not defined in the route

B. Incorrect use of abort function

C. Missing import of user object

D. Route decorator syntax is wrong

Solution

1. Step 1: Check variable usage inside the route

   The code uses user.is_admin but user is not defined or passed in the function.

2. Step 2: Confirm other parts are correct

   abort is used correctly, and the route decorator syntax is fine.

3. Final Answer:

   user variable is not defined in the route -> Option A

4. Quick Check:

   Undefined user variable causes error [OK]

Hint: Ensure variables used in routes are defined or passed [OK]

Common Mistakes:

• Assuming user is globally available without definition
• Misusing abort syntax
• Thinking route decorator is incorrect

5. You want to create a helper function check_permission() that aborts with 403 if the user is not an admin. Which of these is the best way to use it in a Flask route?

hard

A. Call check_permission() after returning the response

B. Replace the route function with check_permission() entirely

C. Use check_permission() only in templates, not routes

D. Call check_permission() inside the route before returning content

Solution

1. Step 1: Understand when permission checks should run

   Permission checks must happen before sending the response to block unauthorized access early.

2. Step 2: Evaluate the options for calling the helper

   Calling it inside the route before returning content ensures unauthorized users are stopped properly.

3. Final Answer:

   Call check_permission() inside the route before returning content -> Option D

4. Quick Check:

   Check permissions before response [OK]

Hint: Check permissions before returning response [OK]

Common Mistakes:

• Calling permission check after response is sent
• Trying to check permissions in templates
• Replacing route with permission check function