Role-based access control in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Role-based Access Control (RBAC)?

RBAC is a way to control who can do what in an app by assigning roles to users. Each role has permissions that allow certain actions.

intermediate

How do you define roles in a Flask app using Flask-Login and Flask-Principal?

You create roles as strings or database entries and assign them to users. Flask-Principal helps check these roles to allow or deny access.

beginner

What is the purpose of the @login_required decorator in Flask?

It ensures that only logged-in users can access a route. It is often combined with role checks for RBAC.

intermediate

How can you restrict a Flask route to only users with the 'admin' role?

You check the user's roles inside the route or use Flask-Principal's @roles_required('admin') decorator to allow access only to admins.

beginner

Why is RBAC better than giving permissions directly to users?

RBAC makes managing permissions easier by grouping them into roles. When a user's role changes, their permissions update automatically.

In Flask RBAC, what does a 'role' represent?

A A database table

B A user’s password

C A Flask extension

D A group of permissions assigned to users

A role groups permissions that define what actions a user can perform.

Which Flask extension helps manage user sessions and login status?

A Flask-WTF

B Flask-Migrate

C Flask-Login

D Flask-SQLAlchemy

Flask-Login manages user sessions and login states.

What decorator would you use to require a user to be logged in before accessing a route?

A @login_required

B @roles_required

C @app.route

D @permission_required

@login_required ensures only logged-in users can access the route.

How do you check if a user has the 'admin' role in Flask?

A Check if 'admin' is in user.roles

B Check if user.is_admin is True

C Check if user.password == 'admin'

D Check if user.id == 'admin'

User roles are usually stored in a list or set; checking membership confirms role.

Why is it better to assign roles instead of individual permissions to users?

A Users prefer roles over permissions

B Roles simplify permission management

C Permissions are not secure

D Roles make the app slower

Roles group permissions, making it easier to manage user access.

Explain how Role-based Access Control works in a Flask application.

Think about how you decide who can enter certain rooms in a building.

Describe how you would implement a route that only 'admin' users can access in Flask.

Consider using decorators and role membership checks.