Role-based access control in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask route with role check?

Consider this Flask route that checks user roles before allowing access. What will be the response if the user role is 'guest'?

Flask

from flask import Flask, abort, request
app = Flask(__name__)

@app.route('/dashboard')
def dashboard():
    user_role = request.args.get('role')
    if user_role != 'admin':
        abort(403)
    return 'Welcome to admin dashboard!'

# Simulate request with role='guest'

A HTTP 403 Forbidden error

B Welcome to admin dashboard!

C HTTP 404 Not Found error

D HTTP 500 Internal Server Error

💡 Hint

Think about what happens when the role is not 'admin'.

The route aborts with a 403 error if the user role is anything other than 'admin'. Since the role is 'guest', access is denied.

❓ state_output

intermediate

What is the value of 'access_granted' after this role check?

Given this snippet, what is the value of access_granted after execution?

Flask

user_roles = ['editor', 'contributor']
required_role = 'admin'
access_granted = required_role in user_roles

A true

B null

C 'admin'

D false

💡 Hint

Check if 'admin' is inside the list user_roles.

The list user_roles does not contain 'admin', so the expression evaluates to false.

📝 Syntax

advanced

Which option correctly defines a Flask decorator to restrict access by role?

Which code snippet correctly implements a Flask decorator @role_required('admin') that aborts with 403 if the user role is not 'admin'?

A

def role_required(role):
    def decorator(f):
        if request.args.get('role') != role:
            abort(403)
        return f
    return decorator

B

def role_required(role):
    def decorator(f):
        def wrapper(*args, **kwargs):
            if request.args.get('role') != role:
                abort(403)
            return f(*args, **kwargs)
        return wrapper
    return decorator

C

def role_required(role):
    def wrapper(f):
        if request.args.get('role') != role:
            abort(403)
        return f
    return wrapper

D

def role_required(role):
    def decorator(f):
        def wrapper():
            if request.args.get('role') != role:
                abort(403)
            return f()
        return wrapper
    return decorator

💡 Hint

Remember a decorator returns a function that wraps the original function and accepts any arguments.

Option B correctly defines a decorator factory that returns a decorator, which returns a wrapper function accepting any arguments and performs the role check before calling the original function.

🔧 Debug

advanced

Why does this Flask role check code raise a RuntimeError?

Given this Flask route, why does it raise a RuntimeError: Working outside of request context?

Flask

from flask import Flask, abort, request
app = Flask(__name__)

user_role = request.args.get('role')

@app.route('/profile')
def profile():
    if user_role != 'user':
        abort(403)
    return 'User profile page'

A Because 'request.args.get' is called outside a request context, before any request is handled.

B Because 'abort' is used incorrectly inside the route function.

C Because the route function 'profile' is missing a return statement.

D Because Flask app is not run with debug=true.

💡 Hint

Think about when Flask's request object is available.

The request object is only available during an active HTTP request. Accessing it at the module level (outside any route) causes a RuntimeError.

🧠 Conceptual

expert

Which statement best describes role-based access control (RBAC) in Flask apps?

Choose the most accurate description of how RBAC is typically implemented in Flask applications.

A RBAC automatically encrypts user passwords to secure roles in Flask apps.

B RBAC requires Flask to use class-based views exclusively for role checks.

C RBAC restricts access by checking user roles stored in session or token before executing route logic.

D RBAC is handled by Flask's built-in user interface components.

💡 Hint

Think about how roles are checked before allowing access.

RBAC in Flask usually involves checking user roles stored in session data or tokens before allowing access to certain routes or functions.