Why authentication matters in Flask - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is authentication important in a Flask web app?

Imagine you have a Flask app where users can see their personal data. Why do you need authentication?

A To change the app's color scheme

B To allow anyone to edit all users' data

C To make the app load faster

D To make sure only the right user can see their own data

💡 Hint

Think about privacy and safety of user information.

Authentication confirms who the user is, so the app shows only their data and keeps others safe.

❓ component_behavior

intermediate

What happens if a Flask route lacks authentication?

Consider a Flask route that shows user profile info but has no authentication check. What is the likely result?

A Anyone can access any user's profile data

B Only logged-in users can see their profiles

C The app crashes with an error

D The profile page shows a loading spinner forever

💡 Hint

Think about what happens if no one checks who is visiting the page.

Without authentication, the app cannot restrict access, so anyone can see any profile.

❓ state_output

advanced

What is the output of this Flask login check code?

Given this Flask snippet, what will be printed if a user is not logged in?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/dashboard')
def dashboard():
    if 'user_id' in session:
        return 'Welcome user!'
    else:
        return 'Please log in first.'

# Assume session is empty (no user_id)

A KeyError: 'user_id'

B 500 Internal Server Error

C Please log in first.

D Welcome user!

💡 Hint

Check what happens when 'user_id' is missing in session.

The code checks if 'user_id' is in session. If not, it returns the login prompt.

📝 Syntax

advanced

Which Flask code snippet correctly protects a route with login required?

Choose the code that correctly uses Flask-Login to protect a route so only logged-in users can access it.

A

@app.route('/profile')
def profile():
    if current_user.is_authenticated:
        return 'User Profile'
    else:
        return 'Access Denied'

B

@app.route('/profile')
@login_required
def profile():
    return 'User Profile'

C

@app.route('/profile')
@requires_login
def profile():
    return 'User Profile'

D

@app.route('/profile')
def profile():
    if user.is_logged_in:
        return 'User Profile'
    else:
        return 'Access Denied'

💡 Hint

Flask-Login provides a decorator named login_required.

Option B uses the correct @login_required decorator from Flask-Login to protect the route.

🔧 Debug

expert

Why does this Flask login code raise an error?

Examine the code below. Why does it raise a RuntimeError: Working outside of request context?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

user_id = session.get('user_id')

@app.route('/')
def home():
    return f'User ID is {user_id}'

A Because session is accessed outside a request, before any client request happens

B Because Flask app is not run with debug=True

C Because the route function is missing a return statement

D Because secret_key is missing

💡 Hint

Think about when Flask allows access to session.

Accessing session outside a request context (like at module level) causes this error.