Role-based access control in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Flask-Login extension needed for user session management.

Flask

from flask_login import [1]

Drag options to blanks, or click blank then click option'

ALoginManager

BUserMixin

Ccurrent_user

Dlogin_required

Attempts:

3 left

💡 Hint

Common Mistakes

Importing UserMixin instead of LoginManager

Using login_required decorator here

The LoginManager class is imported to manage user sessions and handle login-related tasks in Flask.

2fill in blank

medium

Complete the code to protect a Flask route so only logged-in users can access it.

Flask

@app.route('/dashboard')
@[1]
def dashboard():
    return 'Welcome to your dashboard!'

Drag options to blanks, or click blank then click option'

Acurrent_user

Blogin_manager

Cuser_loader

Dlogin_required

Attempts:

3 left

💡 Hint

Common Mistakes

Using login_manager as decorator

Using current_user as decorator

The @login_required decorator restricts access to the route to only logged-in users.

3fill in blank

hard

Fix the error in the user loader function to load a user by ID.

Flask

@login_manager.user_loader
def load_user([1]):
    return User.query.get(int(user_id))

Drag options to blanks, or click blank then click option'

Aid

Buser

Cuser_id

Duid

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' or 'id' instead of 'user_id' as parameter name

The parameter must be named user_id to match the variable used inside the function.

4fill in blank

hard

Fill both blanks to check if the current user has the 'admin' role and restrict access accordingly.

Flask

from flask_login import current_user
from flask import abort

@app.route('/admin')
def admin_panel():
    if current_user.[1]('admin'):
        return 'Welcome Admin'
    else:
        return [2]('Access denied', 403)

Drag options to blanks, or click blank then click option'

Ahas_role

Babort

Credirect

Dlogin_required

Attempts:

3 left

💡 Hint

Common Mistakes

Using redirect instead of abort for access denial

Using login_required inside the function incorrectly

The has_role method checks if the user has the 'admin' role. abort(403) sends a forbidden error if not authorized.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps usernames to their roles only if the user is active.

Flask

user_roles = {user.[1]: user.[2] for user in users if user.[3]

Drag options to blanks, or click blank then click option'

Ausername

Brole

Cis_active

Demail

Attempts:

3 left

💡 Hint

Common Mistakes

Using email instead of username

Checking wrong attribute for active status

This comprehension creates a dictionary with usernames as keys and roles as values, but only for users who are active.