Request validation in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when sending invalid JSON to this Flask route?

Consider this Flask route that expects JSON data with a 'name' key:

from flask import Flask, request, jsonify
app = Flask(__name__)

@app.route('/hello', methods=['POST'])
def hello():
    data = request.get_json(force=True)
    if 'name' not in data:
        return jsonify({'error': 'Missing name'}), 400
    return jsonify({'message': f"Hello, {data['name']}!"})

What happens if the client sends a POST request with invalid JSON body?

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)

@app.route('/hello', methods=['POST'])
def hello():
    data = request.get_json(force=True)
    if 'name' not in data:
        return jsonify({'error': 'Missing name'}), 400
    return jsonify({'message': f"Hello, {data['name']}!"})

A The server raises a 400 Bad Request error due to JSON decoding failure.

B The server returns a 200 OK with message 'Hello, None!' because data is None.

C The server returns a 200 OK with an empty JSON object.

D The server returns a 400 Bad Request error with a JSON error message about invalid JSON.

💡 Hint

Think about what happens when force=True is used and the JSON is invalid.

Using request.get_json(force=True) forces Flask to parse the body as JSON even if the content type is wrong. If the JSON is invalid, Flask raises a BadRequest exception, which results in a 400 Bad Request error if not handled.

❓ state_output

intermediate

What is the response when required fields are missing in validated request data?

Given this Flask route using request.get_json() and manual validation:

@app.route('/register', methods=['POST'])
def register():
    data = request.get_json()
    if not data or 'username' not in data or 'password' not in data:
        return {'error': 'Missing fields'}, 422
    return {'status': 'success', 'user': data['username']}

What response does the server send if the client sends {"username": "alice"} JSON?

Flask

@app.route('/register', methods=['POST'])
def register():
    data = request.get_json()
    if not data or 'username' not in data or 'password' not in data:
        return {'error': 'Missing fields'}, 422
    return {'status': 'success', 'user': data['username']}

A HTTP 200 with JSON {'status': 'success', 'user': 'alice'}

B HTTP 500 Internal Server Error

C HTTP 400 with empty response body

D HTTP 422 with JSON {'error': 'Missing fields'}

💡 Hint

Check if all required keys are present in the JSON data.

The route checks if password is missing and returns a 422 error with a message. Since the client sent only username, the response is 422 with the error JSON.

📝 Syntax

advanced

Which option correctly uses Flask's request validation with Marshmallow schema?

Given a Marshmallow schema UserSchema to validate incoming JSON, which Flask route code correctly validates and returns errors if invalid?

Flask

from flask import Flask, request, jsonify
from marshmallow import Schema, fields, ValidationError

app = Flask(__name__)

class UserSchema(Schema):
    username = fields.Str(required=True)
    age = fields.Int(required=True)

@app.route('/user', methods=['POST'])
def create_user():
    # Validation code here
    pass

A

data = request.json
schema = UserSchema()
validated = schema.validate(data)
if validated:
    return jsonify(validated), 400
return jsonify(data), 201

B

data = request.get_json(force=True)
schema = UserSchema()
validated = schema.load(data)
return jsonify(validated), 201

C

data = request.get_json()
schema = UserSchema()
try:
    validated = schema.load(data)
except ValidationError as err:
    return jsonify(err.messages), 400
return jsonify(validated), 201

D

data = request.get_json()
schema = UserSchema()
validated = schema.dump(data)
return jsonify(validated), 201

💡 Hint

Remember that load validates and deserializes, and raises ValidationError on failure.

Option C correctly uses schema.load() inside a try-except block to catch validation errors and return them with a 400 status. Other options misuse validate or dump or omit error handling.

🔧 Debug

advanced

Why does this Flask route always return 400 even with valid JSON?

Examine this Flask route:

@app.route('/data', methods=['POST'])
def data():
    data = request.get_json(force=True)
    if not data:
        return {'error': 'No data'}, 400
    return {'received': data}

Clients send valid JSON but always get 400 with 'No data'. Why?

Flask

@app.route('/data', methods=['POST'])
def data():
    data = request.get_json(force=True)
    if not data:
        return {'error': 'No data'}, 400
    return {'received': data}

A Using force=True causes get_json to always return None on valid JSON.

B The JSON sent is an empty object {}, which is falsy in Python, triggering the error.

C The route is missing content-type check, so get_json returns None even for valid JSON.

D The request method is not POST, so get_json returns None.

💡 Hint

Think about how Python treats empty dictionaries in boolean contexts.

An empty dictionary {} is falsy in Python, so if not data is true and returns 400. The client likely sends an empty JSON object, which is valid but triggers the error.

🧠 Conceptual

expert

Which statement best describes Flask request validation best practices?

Choose the best practice for validating incoming JSON requests in Flask applications.

A Use a validation library like Marshmallow to define schemas and handle validation and error reporting cleanly.

B Always use <code>request.get_json(force=True)</code> and manually check keys to ensure data validity.

C Trust client data and validate only after processing to improve performance.

D Use <code>request.data</code> and parse JSON manually with <code>json.loads</code> to control validation.

💡 Hint

Consider maintainability and clear error handling in your choice.

Using a validation library like Marshmallow allows clear schema definitions, automatic validation, and consistent error messages. Manual checks or forcing JSON parsing can lead to errors or messy code.