Template-level authorization in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What will this Flask template render when user is not admin?

Consider this Flask Jinja2 template snippet:

{% if current_user.is_admin %}
  
{% else %}
  
You do not have permission to delete posts.
{% endif %}

If current_user.is_admin is False, what will be rendered?

A <p>You do not have permission to delete posts.</p>

B <button>Delete Post</button>

C Nothing will be rendered

D An error will occur because current_user is undefined

💡 Hint

Think about how the {% if %} condition controls what is shown.

The template checks if current_user.is_admin is true. If false, it shows the <p> message. So option A is correct.

📝 Syntax

intermediate

Identify the syntax error in this Jinja2 authorization check

Which option contains a syntax error in this template authorization snippet?

{% if user.is_authenticated and user.is_admin %}
  
Welcome, admin!
{% endif %}

A

{% if user.is_authenticated && user.is_admin %}
  <p>Welcome, admin!</p>
{% endif %}

B

{% if user.is_authenticated and user.is_admin %}
  <p>Welcome, admin!</p>
{% endif %}

C

{% if user.is_authenticated and user.is_admin %}
  <p>Welcome, admin!</p>
{% end %}

D

{% if user.is_authenticated and user.is_admin %}
  <p>Welcome, admin!</p>

💡 Hint

Check the logical operator syntax in Jinja2.

Jinja2 uses and not && for logical AND. Option A uses invalid &&, causing a syntax error.

❓ state_output

advanced

What is the output when user is authenticated but not admin?

Given this Flask template snippet:

{% if user.is_authenticated %}
  {% if user.is_admin %}
    
Admin Panel
  {% else %}
    
User Dashboard
  {% endif %}
{% else %}
  
Please log in.
{% endif %}

If user.is_authenticated is True and user.is_admin is False, what will be rendered?

A <p>Admin Panel</p>

B Nothing will be rendered

C <p>Please log in.</p>

D <p>User Dashboard</p>

💡 Hint

Follow the nested {% if %} conditions carefully.

The user is authenticated but not admin, so the inner {% else %} branch runs, showing User Dashboard.

🔧 Debug

advanced

Why does this template raise an error when user is None?

Consider this template snippet:

{% if user.is_admin %}
  
Admin content
{% else %}
  
Regular content
{% endif %}

If user is None, what error occurs and why?

A TypeError because user is not a boolean

B SyntaxError due to missing endif

C AttributeError because NoneType has no attribute 'is_admin'

D No error, renders 'Regular content'

💡 Hint

Think about what happens when you try to access a property on None.

Accessing user.is_admin when user is None causes an AttributeError because NoneType has no such attribute.

🧠 Conceptual

expert

Which template-level authorization approach prevents unauthorized content rendering best?

In Flask templates, which approach best ensures unauthorized users cannot see admin-only content?

A Render all content and rely on CSS to hide admin sections from unauthorized users

B Use <code>{% if current_user.is_admin %}</code> to conditionally show admin content in templates

C Send all data to the template and use JavaScript to hide admin content on the client side

D Do not check authorization in templates; only check in backend routes

💡 Hint

Think about where content is actually removed versus just hidden.

Using template-level {% if %} checks prevents unauthorized content from being sent to the browser, which is more secure than hiding with CSS or JavaScript. Backend checks alone are not enough if templates render all content.