Why authorization matters in Flask - See It in Action

Why authorization matters

📖 Scenario: You are building a simple web app where users can see their own profile information. Authorization ensures that users cannot see or change other users' data.

🎯 Goal: Create a Flask app that stores user profiles and only shows the logged-in user's profile page. This teaches why authorization is important to protect user data.

📋 What You'll Learn

Create a dictionary called users with exact user data

Create a variable called current_user to simulate logged-in user

Use a Flask route /profile that shows only the current user's profile

Add a check to prevent access to other users' profiles

💡 Why This Matters

🌍 Real World

Authorization is critical in web apps to protect user data and privacy. This project shows a simple way to restrict access to user profiles.

💼 Career

Understanding authorization helps you build secure web applications and is a key skill for backend and full-stack developers.

1

DATA SETUP: Create user data dictionary

Create a dictionary called users with these exact entries: 'alice': {'name': 'Alice', 'age': 30}, 'bob': {'name': 'Bob', 'age': 25}, 'carol': {'name': 'Carol', 'age': 27}.

Flask

# Create the users dictionary with exact entries
# Your code here

Hint

Use a dictionary with usernames as keys and another dictionary for their details.

2

CONFIGURATION: Set current logged-in user

Create a variable called current_user and set it to the string 'bob' to simulate the logged-in user.

Flask

users = {
    'alice': {'name': 'Alice', 'age': 30},
    'bob': {'name': 'Bob', 'age': 25},
    'carol': {'name': 'Carol', 'age': 27}
}

# Set the current logged-in user
# Your code here

Hint

Just assign the string 'bob' to the variable current_user.

3

CORE LOGIC: Create Flask route to show current user's profile

Import Flask and create an app. Then create a route /profile that returns the profile of the current_user from the users dictionary as a string.

Flask

from flask import Flask

app = Flask(__name__)

# Create /profile route to show current_user's profile
# Your code here

Hint

Use @app.route('/profile') and a function that returns the current user's info from the dictionary.

4

COMPLETION: Add authorization check to prevent access to other users

Modify the /profile route to accept a username parameter from the URL path like /profile/<username>. Return the profile only if username matches current_user. Otherwise, return the string 'Unauthorized'.

Flask

from flask import Flask

app = Flask(__name__)

users = {
    'alice': {'name': 'Alice', 'age': 30},
    'bob': {'name': 'Bob', 'age': 25},
    'carol': {'name': 'Carol', 'age': 27}
}

current_user = 'bob'

# Modify /profile route to accept username and check authorization
# Your code here

Hint

Use a URL parameter <username> and compare it to current_user inside the route function.

Practice

1. Why is authorization important in a Flask web application?

easy

A. It speeds up the app's loading time.

B. It helps with styling the web pages.

C. It controls which users can access certain parts of the app.

D. It automatically fixes bugs in the code.

Solution

1. Step 1: Understand the purpose of authorization

   Authorization is about controlling user access to different parts of an app based on their roles or permissions.

2. Step 2: Compare options with authorization purpose

   Only It controls which users can access certain parts of the app. correctly describes this control. Other options describe unrelated features.

3. Final Answer:

   It controls which users can access certain parts of the app. -> Option C

4. Quick Check:

   Authorization = Access control [OK]

Hint: Authorization means controlling user access rights [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking authorization improves speed
• Mixing authorization with UI styling

2. Which Flask code snippet correctly checks if a user has the 'admin' role before allowing access?

easy

A. if current_user.role == 'admin':
return 'Access granted'

B. if current_user == 'admin':
return 'Access granted'

C. if user.role = 'admin':
return 'Access granted'

D. if current_user.role != 'admin':
return 'Access granted'

Solution

1. Step 1: Identify correct role check syntax

   In Flask, to check a user's role, use 'current_user.role == "admin"'.

2. Step 2: Eliminate incorrect syntax and logic

   if current_user == 'admin': return 'Access granted' compares user object to string, incorrect. if user.role = 'admin': return 'Access granted' uses single '=', which is assignment, not comparison. if current_user.role != 'admin': return 'Access granted' grants access if role is not admin, which is wrong logic.

3. Final Answer:

   if current_user.role == 'admin': return 'Access granted' -> Option A

4. Quick Check:

   Correct role check uses '==' and proper attribute [OK]

Hint: Use '==' to compare role strings, not '=' [OK]

Common Mistakes:

• Using '=' instead of '==' for comparison
• Comparing user object directly to string
• Reversing logic with '!=' instead of '=='

3. Given this Flask route code, what will be the output if a user with role 'guest' accesses it?

from flask import abort

@app.route('/admin')
def admin_panel():
    if current_user.role != 'admin':
        abort(403)
    return 'Welcome, admin!'

medium

A. 500 Internal Server Error

B. Welcome, admin!

C. 404 Not Found error page

D. 403 Forbidden error page

Solution

1. Step 1: Analyze role check condition

   The code aborts with 403 error if the user's role is not 'admin'. A 'guest' role triggers this condition.

2. Step 2: Determine output for guest user

   Since 'guest' != 'admin', abort(403) runs, showing a 403 Forbidden error page.

3. Final Answer:

   403 Forbidden error page -> Option D

4. Quick Check:

   Non-admin user triggers abort(403) [OK]

Hint: abort(403) means access denied error [OK]

Common Mistakes:

• Thinking non-admin sees welcome message
• Confusing 403 with 404 error
• Assuming server error instead of access error

4. Identify the error in this Flask authorization code snippet:

@app.route('/dashboard')
def dashboard():
    if current_user.role = 'admin':
        return 'Admin dashboard'
    else:
        return 'User dashboard'

medium

A. Using '=' instead of '==' in the if condition

B. Missing return statement in else block

C. Incorrect route decorator syntax

D. No error, code is correct

Solution

1. Step 1: Check the if condition syntax

   The condition uses '=' which is assignment, not comparison. It should be '=='.

2. Step 2: Verify other parts of the code

   Else block has a return, route decorator syntax is correct, so no other errors.

3. Final Answer:

   Using '=' instead of '==' in the if condition -> Option A

4. Quick Check:

   Comparison needs '==' not '=' [OK]

Hint: Use '==' for comparisons, '=' is assignment [OK]

Common Mistakes:

• Confusing assignment '=' with comparison '=='
• Assuming missing return in else block
• Thinking route decorator is wrong

5. You want to protect a Flask route so only users with roles 'admin' or 'manager' can access it. Which code correctly implements this authorization check?

@app.route('/reports')
def reports():
    if current_user.role in ['admin', 'manager']:
        return 'Reports page'
    else:
        abort(403)

hard

A. if current_user.role == 'admin' or 'manager':
return 'Reports page'
else:
abort(403)

B. if current_user.role in ['admin', 'manager']:
return 'Reports page'
else:
abort(403)

C. if current_user.role == 'admin' and current_user.role == 'manager':
return 'Reports page'
else:
abort(403)

D. if current_user.role != 'admin' or current_user.role != 'manager':
return 'Reports page'
else:
abort(403)

Solution

1. Step 1: Understand role check for multiple roles

   To allow access for either 'admin' or 'manager', use 'in' with a list of roles.

2. Step 2: Evaluate each option's logic

   if current_user.role in ['admin', 'manager']: return 'Reports page' else: abort(403) correctly uses 'in' to check if role is in the list. if current_user.role == 'admin' or 'manager': return 'Reports page' else: abort(403) always returns true because 'or "manager"' is always truthy. if current_user.role == 'admin' and current_user.role == 'manager': return 'Reports page' else: abort(403) requires role to be both 'admin' and 'manager' simultaneously, impossible. if current_user.role != 'admin' or current_user.role != 'manager': return 'Reports page' else: abort(403) logic is inverted and incorrect.

3. Final Answer:

   if current_user.role in ['admin', 'manager']: return 'Reports page' else: abort(403) -> Option B

4. Quick Check:

   Use 'in' to check multiple roles [OK]

Hint: Use 'in' to check if role is in a list [OK]

Common Mistakes:

• Using 'or' incorrectly causing always true
• Using 'and' requiring impossible dual roles
• Inverting logic with '!=' causing wrong access