Template-level authorization in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the user is authenticated in the Flask template.

Flask

{% if [1] %}
  <p>Welcome, user!</p>
{% endif %}

Drag options to blanks, or click blank then click option'

Acurrent_user.is_authenticated

Buser.is_authenticated

Cauth.is_authenticated

Dsession.is_authenticated

Attempts:

3 left

💡 Hint

Common Mistakes

Using user.is_authenticated which is undefined in the template.

Trying to access session.is_authenticated which does not exist.

In Flask with Flask-Login, current_user.is_authenticated is used to check if the user is logged in.

2fill in blank

medium

Complete the code to show a logout link only if the user is authenticated.

Flask

{% if [1] %}
  <a href="/logout">Logout</a>
{% endif %}

Drag options to blanks, or click blank then click option'

Asession.logged_in

Bauth.is_authenticated

Cuser.logged_in

Dcurrent_user.is_authenticated

Attempts:

3 left

💡 Hint

Common Mistakes

Using session.logged_in which is not standard in Flask-Login.

Using undefined variables like user.logged_in.

The correct way to check authentication in Flask templates is current_user.is_authenticated.

3fill in blank

hard

Fix the error in the template code to correctly check if the user has the 'admin' role.

Flask

{% if [1] %}
  <p>Admin Panel</p>
{% endif %}

Drag options to blanks, or click blank then click option'

Acurrent_user.roles.contains('admin')

B'admin' in current_user.roles

C'admin' == current_user.roles

Dcurrent_user.role == 'admin'

Attempts:

3 left

💡 Hint

Common Mistakes

Using equality operator to compare string to list.

Using a method contains which does not exist in Python lists.

Assuming current_user.roles is a list, use 'admin' in current_user.roles to check membership.

4fill in blank

hard

Fill both blanks to display a message only if the user is authenticated and has the 'editor' role.

Flask

{% if [1] and [2] %}
  <p>Editor Access Granted</p>
{% endif %}

Drag options to blanks, or click blank then click option'

Acurrent_user.is_authenticated

B'editor' in current_user.roles

Ccurrent_user.role == 'editor'

Duser.is_authenticated

Attempts:

3 left

💡 Hint

Common Mistakes

Using current_user.role == 'editor' which assumes a single role string.

Using undefined variable user.is_authenticated.

Check both if the user is logged in and if 'editor' is in their roles list.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps usernames to emails only for authenticated users with verified emails.

Flask

{% raw %}{% set user_emails = { [1]: [2] for [3] in users if current_user.is_authenticated and user.verified } %}{% endraw %}

Drag options to blanks, or click blank then click option'

Auser.username

Buser.email

Cuser

Dusername

Attempts:

3 left

💡 Hint

Common Mistakes

Using undefined variable username as loop variable.

Swapping key and value in the dictionary comprehension.

In the comprehension, user is the loop variable, user.username is the key, and user.email is the value.

Practice

1. What is the main purpose of using template-level authorization in a Flask application?

easy

A. To control what content users can see based on their roles or permissions

B. To speed up the loading time of templates

C. To change the style of the webpage dynamically

D. To store user data securely in the database

Solution

1. Step 1: Understand template-level authorization

   Template-level authorization is about controlling visibility of content in templates based on user roles or permissions.

2. Step 2: Identify the main purpose

   The main goal is to restrict or allow content display depending on who the user is.

3. Final Answer:

   To control what content users can see based on their roles or permissions -> Option A

4. Quick Check:

   Authorization controls content visibility [OK]

Hint: Authorization controls content visibility in templates [OK]

Common Mistakes:

• Confusing authorization with styling or performance
• Thinking it stores data instead of controlling view
• Mixing backend data storage with frontend display control

2. Which of the following is the correct way to check a user's role in a Flask Jinja2 template?

easy

A. {{ if user.role == 'admin' }} ... {{ endif }}

B. {% check user.role == 'admin' %} ... {% endcheck %}

C. {% if user.role == 'admin' %} ... {% endif %}

D. <% if user.role == 'admin' %> ... <% endif %>

Solution

1. Step 1: Recall Jinja2 syntax for conditionals

   Jinja2 uses {% if condition %} ... {% endif %} blocks for conditional rendering.

2. Step 2: Match syntax with options

   {% if user.role == 'admin' %} ... {% endif %} uses correct Jinja2 syntax. The other options use invalid or other template syntax.

3. Final Answer:

   {% if user.role == 'admin' %} ... {% endif %} -> Option C

4. Quick Check:

   Jinja2 uses {% if %} ... {% endif %} [OK]

Hint: Use {% if %} ... {% endif %} for conditions in Jinja2 templates [OK]

Common Mistakes:

• Using {{ }} for control flow instead of {% %}
• Confusing Jinja2 with other template languages
• Using incorrect tags like <% %> which are not Jinja2

3. Given this Flask template snippet:

{% if user.is_authenticated and user.role == 'editor' %}
  
Edit content here
{% else %}
  
View only
{% endif %}

What will be displayed if user.is_authenticated is True but user.role is 'viewer'?

medium

A. Edit content here

B. View only

C. Nothing will be displayed

D. Template error occurs

Solution

1. Step 1: Evaluate the condition

   The condition requires user.is_authenticated to be True AND user.role to be 'editor'. Here, role is 'viewer', so condition is False.

2. Step 2: Determine which block runs

   Since condition is False, the else block runs, displaying <p>View only</p>.

3. Final Answer:

   <p>View only</p> -> Option B

4. Quick Check:

   Condition false triggers else block [OK]

Hint: Check both conditions; else block shows if any fail [OK]

Common Mistakes:

• Assuming only one condition matters
• Thinking 'viewer' role passes the 'editor' check
• Expecting no output when else block exists

4. You have this template code:

{% if user.role = 'admin' %}
  
Admin panel
{% endif %}

What is the problem with this code?

medium

A. Using <p> tags inside a template is not allowed

B. Missing else block for non-admin users

C. Incorrect indentation inside the if block

D. Using single equals sign (=) instead of double equals (==) in the if condition

Solution

1. Step 1: Identify the conditional syntax error

   In Jinja2, comparisons use '==' not '='. '=' is assignment and invalid in if conditions.

2. Step 2: Understand the impact

   Using '=' causes a template syntax error and prevents rendering.

3. Final Answer:

   Using single equals sign (=) instead of double equals (==) in the if condition -> Option D

4. Quick Check:

   Use '==' for comparisons in Jinja2 if statements [OK]

Hint: Use '==' for comparisons, '=' causes errors [OK]

Common Mistakes:

• Using '=' instead of '==' in conditions
• Thinking missing else causes syntax error
• Believing HTML tags are disallowed in templates

5. You want to show a special admin menu only if the user is authenticated and has either 'admin' or 'superuser' role. Which template code correctly implements this?

hard

A. {% if user.is_authenticated and user.role in ['admin', 'superuser'] %}
Admin Menu
{% endif %}

B. {% if user.is_authenticated or user.role == 'admin' or user.role == 'superuser' %}
Admin Menu
{% endif %}

C. {% if user.is_authenticated and user.role == 'admin' or 'superuser' %}
Admin Menu
{% endif %}

D. {% if user.is_authenticated and user.role == 'admin' or user.role == 'superuser' %}
Admin Menu
{% endif %}

Solution

1. Step 1: Understand the condition requirements

   User must be authenticated AND have role 'admin' OR 'superuser'.

2. Step 2: Analyze each option

   {% if user.is_authenticated and user.role == 'admin' or user.role == 'superuser' %}
   Admin Menu
   {% endif %} lacks parentheses around the or conditions, resulting in incorrect logic: (is_authenticated and role=='admin') or role=='superuser' due to operator precedence. {% if user.is_authenticated or user.role == 'admin' or user.role == 'superuser' %}
   Admin Menu
   {% endif %} uses or between authentication and roles, allowing unauthenticated users. {% if user.is_authenticated and user.role == 'admin' or 'superuser' %}
   Admin Menu
   {% endif %} has incorrect syntax and logic. {% if user.is_authenticated and user.role in ['admin', 'superuser'] %} <nav>Admin Menu</nav> {% endif %} uses 'in' to check role membership, which is clean and correct.

3. Final Answer:

   {% if user.is_authenticated and user.role in ['admin', 'superuser'] %} <nav>Admin Menu</nav> {% endif %} -> Option A

4. Quick Check:

   Use 'in' for multiple role checks with and for authentication [OK]

Hint: Use 'and' plus 'in' to check multiple roles cleanly [OK]

Common Mistakes:

• Using 'or' instead of 'and' for authentication
• Incorrect syntax for multiple role checks
• Missing parentheses causing logic errors