Role-based access control in Flask

Introduction

Role-based access control helps decide who can do what in a web app. It keeps things safe by letting only the right people use certain parts.

You want only admins to change settings on your website.

You want users to see their own data but not others'.

You want to hide some pages from visitors who are not logged in.

You want to give different permissions to different user groups.

You want to protect sensitive actions like deleting or editing content.

Syntax

Flask

from flask import Flask, redirect, url_for, request
from functools import wraps

app = Flask(__name__)

# Example user data with roles
users = {
    'alice': 'admin',
    'bob': 'editor',
    'carol': 'viewer'
}

# Decorator to check user role
def role_required(role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            username = request.args.get('user')
            if not username or users.get(username) != role:
                return "Access denied", 403
            return f(*args, **kwargs)
        return decorated_function
    return decorator

@app.route('/admin')
@role_required('admin')
def admin_panel():
    return "Welcome to the admin panel!"

if __name__ == '__main__':
    app.run()

The role_required function is a decorator that checks if the user has the right role.

We get the username from the URL query for simplicity, but real apps use login sessions.

Examples

This protects the admin_page so only users with the 'admin' role can see it.

Flask

@role_required('admin')
def admin_page():
    return "Admin only content"

This allows only editors to access the edit_page.

Flask

@role_required('editor')
def edit_page():
    return "Editor content"

This restricts the page to viewers only.

Flask

@role_required('viewer')
def view_page():
    return "Viewer content"

Sample Program

This Flask app has three pages: admin, edit, and view. Each page is protected by a role check. The user role is checked from the URL query parameter ?user=alice. Only users with the matching role can access the page.

Flask

from flask import Flask, request
from functools import wraps

app = Flask(__name__)

users = {
    'alice': 'admin',
    'bob': 'editor',
    'carol': 'viewer'
}

def role_required(role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            username = request.args.get('user')
            if not username:
                return "No user provided", 400
            user_role = users.get(username)
            if user_role != role:
                return "Access denied", 403
            return f(*args, **kwargs)
        return decorated_function
    return decorator

@app.route('/admin')
@role_required('admin')
def admin_panel():
    return "Welcome to the admin panel!"

@app.route('/edit')
@role_required('editor')
def edit_panel():
    return "Welcome to the editor panel!"

@app.route('/view')
@role_required('viewer')
def view_panel():
    return "Welcome to the viewer panel!"

if __name__ == '__main__':
    app.run(debug=True)

Important Notes

In real apps, user roles come from logged-in user sessions, not URL parameters.

Use HTTPS to keep user info safe when sending requests.

Role checks can be combined to allow multiple roles if needed.

Summary

Role-based access control limits what users can do based on their role.

Use decorators in Flask to protect routes easily.

Always check user identity securely before allowing access.

Practice

1. What is the main purpose of role-based access control (RBAC) in a Flask application?

easy

A. To automatically generate user interfaces

B. To speed up the Flask server response time

C. To restrict user actions based on their assigned roles

D. To store user passwords securely

Solution

1. Step 1: Understand RBAC concept

   RBAC means users can only do things allowed by their roles, like admin or user.

2. Step 2: Identify RBAC purpose in Flask

   In Flask, RBAC limits access to routes or actions based on roles.

3. Final Answer:

   To restrict user actions based on their assigned roles -> Option C

4. Quick Check:

   RBAC = restrict actions by role [OK]

Hint: RBAC controls what users can do by their role [OK]

Common Mistakes:

• Confusing RBAC with performance optimization
• Thinking RBAC manages UI generation
• Mixing RBAC with password security

2. Which Flask decorator is commonly used to protect a route so only logged-in users with a specific role can access it?

easy

A. @csrf_protect

B. @login_required

C. @app.route

D. @role_required('admin')

Solution

1. Step 1: Identify decorators for access control

   @login_required ensures user is logged in but does not check role.

2. Step 2: Find decorator checking specific role

   @role_required('admin') restricts access to users with 'admin' role.

3. Final Answer:

   @role_required('admin') -> Option D

4. Quick Check:

   Role check decorator = @role_required [OK]

Hint: Use @role_required to check user roles on routes [OK]

Common Mistakes:

• Using @login_required alone for role checks
• Confusing @app.route with access control
• Mistaking @csrf_protect for role restriction

3. Given this Flask route code snippet:

@app.route('/dashboard')
@role_required('editor')
def dashboard():
    return 'Welcome Editor'

What happens if a logged-in user with role 'viewer' tries to access '/dashboard'?

medium

A. They get redirected or denied access

B. They can access but with limited features

C. They get a server error

D. They see 'Welcome Editor' message

Solution

1. Step 1: Understand role_required decorator effect

   @role_required('editor') allows only users with 'editor' role to access the route.

2. Step 2: Check user role 'viewer' against required 'editor'

   User role 'viewer' does not match 'editor', so access is denied or redirected.

3. Final Answer:

   They get redirected or denied access -> Option A

4. Quick Check:

   Role mismatch = access denied [OK]

Hint: Role mismatch blocks access, not error or partial view [OK]

Common Mistakes:

• Assuming wrong role still shows content
• Expecting server error on role mismatch
• Thinking partial access is automatic

4. Consider this Flask code snippet:

@app.route('/admin')
@role_required('admin')
def admin_panel():
    return 'Admin Panel'

Which of the following is a common mistake that would cause this role check to fail?

medium

A. Not importing the role_required decorator

B. Using @app.route after @role_required

C. Returning a string instead of JSON

D. Defining the function without parentheses

Solution

1. Step 1: Check decorator usage

   role_required must be imported to work; missing import causes failure.

2. Step 2: Verify other options

   @app.route order is flexible; returning string is valid; function definition syntax is correct.

3. Final Answer:

   Not importing the role_required decorator -> Option A

4. Quick Check:

   Missing import breaks decorator [OK]

Hint: Always import decorators before use [OK]

Common Mistakes:

• Assuming decorator order always matters
• Confusing return type with access control
• Syntax errors in function definition

5. You want to create a Flask route /settings that only users with roles 'admin' or 'manager' can access. Which code snippet correctly implements this role-based access control?

hard

A. @app.route('/settings')
@role_required('admin')
@role_required('manager')
def settings():
return 'Settings Page'

B. @app.route('/settings')
def settings():
if current_user.role in ['admin', 'manager']:
return 'Settings Page'
return 'Access Denied'

C. @app.route('/settings')
@role_required(['admin', 'manager'])
def settings():
return 'Settings Page'

D. @app.route('/settings')
@role_required('admin' or 'manager')
def settings():
return 'Settings Page'

Solution

1. Step 1: Analyze multiple role checks

   @app.route('/settings')
   @role_required('admin')
   @role_required('manager')
   def settings():
       return 'Settings Page'

   stacks decorators, which requires both roles simultaneously, not either/or.

2. Step 2: Check list role check in decorator

   @app.route('/settings')
   @role_required(['admin', 'manager'])
   def settings():
       return 'Settings Page'

   assumes role_required accepts list, which may not be supported by default.

3. Step 3: Evaluate logical or misuse

   @app.route('/settings')
   @role_required('admin' or 'manager')
   def settings():
       return 'Settings Page'

   uses 'admin' or 'manager' which evaluates to 'admin' always, incorrect.

4. Step 4: Confirm manual role check

   @app.route('/settings')
   def settings():
       if current_user.role in ['admin', 'manager']:
           return 'Settings Page'
       return 'Access Denied'

   manually checks if user role is in allowed list, correctly allowing either role.

5. Final Answer:

   Option B code with manual role check -> Option B

6. Quick Check:

   Manual role list check allows multiple roles [OK]

Hint: Use if-check for multiple roles if decorator lacks list support [OK]

Common Mistakes:

• Stacking decorators for multiple roles (AND instead of OR)
• Passing list directly to decorator without support
• Using 'or' inside decorator argument incorrectly