Secure headers configuration in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask response header configuration?

Consider this Flask route that sets security headers. What headers will the client receive?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hello')
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response

A {"X-Frame-Options": "DENY", "Content-Security-Policy": "default-src 'self'"}

B {"X-Frame-Options": "SAMEORIGIN", "Content-Security-Policy": "default-src 'none'"}

C {"X-Content-Type-Options": "nosniff", "Content-Security-Policy": "default-src 'self'"}

D {"X-Frame-Options": "ALLOWALL", "Content-Security-Policy": "default-src 'self'"}

💡 Hint

Look at the exact header keys and values set in the code.

The code sets X-Frame-Options to DENY and Content-Security-Policy to default-src 'self'. So the client receives these exact headers.

📝 Syntax

intermediate

Which option causes a syntax error in Flask header setting?

Identify which code snippet will cause a syntax error when setting headers in Flask.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hi')
    # Header setting line below
    # Replace with one of the options
    return response

A response.headers['Content-Security-Policy'] = default-src 'self'

B response.headers['X-Content-Type-Options'] = 'nosniff'

C response.headers['X-Frame-Options'] = 'DENY'

D response.headers['Referrer-Policy'] = 'no-referrer'

💡 Hint

Check if the header value is a valid Python string.

Option A misses quotes around the string value, causing a syntax error. It should be a string literal.

❓ state_output

advanced

What is the value of the 'Strict-Transport-Security' header after this Flask middleware runs?

This Flask middleware adds a security header. What is the header's value after a request?

Flask

from flask import Flask, request
app = Flask(__name__)

@app.after_request
def add_hsts_header(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

@app.route('/')
def index():
    return 'Secure site'

A 'max-age=31536000'

B 'max-age=0; includeSubDomains'

C No 'Strict-Transport-Security' header is set

D 'max-age=31536000; includeSubDomains'

💡 Hint

Look at the exact string assigned to the header in the middleware.

The middleware sets the header to 'max-age=31536000; includeSubDomains' on every response.

🔧 Debug

advanced

Why does this Flask app fail to set the 'X-Content-Type-Options' header?

Given this Flask code, why is the 'X-Content-Type-Options' header missing in the response?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hello')
    response.headers.add('X-Content-Type-Options', 'nosniff')
    return 'Hello World!'

A The header name is misspelled, so it is ignored

B The header is added but the returned value is a string, not the response object

C Flask does not allow setting 'X-Content-Type-Options' header

D The response.headers.add method does not exist

💡 Hint

Check what the route function returns.

The function returns a string instead of the response object with headers set, so headers are lost.

🧠 Conceptual

expert

Which header configuration best prevents clickjacking attacks in Flask?

Choose the header setting that most effectively prevents clickjacking.

A response.headers['X-Frame-Options'] = 'DENY'

B response.headers['X-Content-Type-Options'] = 'nosniff'

C response.headers['Content-Security-Policy'] = "frame-ancestors 'none'"

D response.headers['Referrer-Policy'] = 'no-referrer'

💡 Hint

Both 'X-Frame-Options' and 'Content-Security-Policy' can control framing, but one is more modern and flexible.

While 'X-Frame-Options: DENY' blocks all framing, 'Content-Security-Policy: frame-ancestors 'none'' is a modern, more flexible way to prevent clickjacking and is recommended.

Practice

1. Which Flask feature is commonly used to add secure headers to every response?

easy

A. The @app.before_first_request decorator

B. The @app.route decorator

C. The @app.after_request decorator

D. The @app.teardown_request decorator

Solution

1. Step 1: Understand Flask request lifecycle

   Flask allows modifying responses after the view function runs using @app.after_request.

2. Step 2: Identify where headers are added

   Secure headers are added to the response object, which is accessible in @app.after_request.

3. Final Answer:

   The @app.after_request decorator -> Option C

4. Quick Check:

   Use @app.after_request to add headers [OK]

Hint: Add headers in @app.after_request for all responses [OK]

Common Mistakes:

• Using @app.route which only defines routes
• Trying to add headers in @app.before_first_request which runs once
• Using @app.teardown_request which is for cleanup, not response modification

2. Which of the following is the correct syntax to add a Content-Security-Policy header in Flask?

easy

A. response.set_header('Content-Security-Policy', "default-src 'self'")

B. response.header['Content-Security-Policy'] = "default-src 'self'"

C. response.headers.add('Content-Security-Policy', "default-src 'self'")

D. response.headers['Content-Security-Policy'] = "default-src 'self'"

Solution

1. Step 1: Recall Flask response header syntax

   Flask response headers are a dictionary-like object accessed via response.headers.

2. Step 2: Assign header value correctly

   Use response.headers['Header-Name'] = value to set or overwrite headers.

3. Final Answer:

   response.headers['Content-Security-Policy'] = "default-src 'self'" -> Option D

4. Quick Check:

   Headers set by assignment to response.headers [OK]

Hint: Use response.headers['Name'] = value to set headers [OK]

Common Mistakes:

• Using header instead of headers
• Trying to call set_header which Flask response lacks
• Using headers.add which is not a Flask method

3. Given this Flask code snippet, what will be the value of the X-Frame-Options header in the response?

from flask import Flask, Response
app = Flask(__name__)

@app.after_request
def add_headers(response: Response):
    response.headers['X-Frame-Options'] = 'DENY'
    return response

@app.route('/')
def home():
    return 'Hello'

medium

A. 'DENY'

B. 'SAMEORIGIN'

C. No X-Frame-Options header

D. 'ALLOW-FROM https://example.com'

Solution

1. Step 1: Check header assignment in @app.after_request

   The function sets X-Frame-Options to 'DENY' on every response.

2. Step 2: Confirm header presence in response

   Since the header is set unconditionally, the response will have X-Frame-Options: DENY.

3. Final Answer:

   'DENY' -> Option A

4. Quick Check:

   X-Frame-Options set to 'DENY' in after_request [OK]

Hint: Headers set in @app.after_request apply to all responses [OK]

Common Mistakes:

• Assuming default header values without setting them
• Confusing SAMEORIGIN with DENY
• Thinking header is missing because not set in route

4. Identify the error in this Flask code that tries to add a Strict-Transport-Security header:

from flask import Flask
app = Flask(__name__)

@app.after_request
def secure_headers(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

@app.route('/')
def index():
    return 'Welcome'

medium

A. The header name should be lowercase

B. No error; the code is correct

C. The header value string is missing quotes

D. The function must accept two parameters

Solution

1. Step 1: Review header name and value syntax

   Header names are case-insensitive; using 'Strict-Transport-Security' is valid. The value is a valid string with quotes.

2. Step 2: Check function signature and usage

   @app.after_request functions take one parameter (response) and return it. This matches the code.

3. Final Answer:

   No error; the code is correct -> Option B

4. Quick Check:

   Header added correctly in @app.after_request [OK]

Hint: Check function signature and header syntax carefully [OK]

Common Mistakes:

• Thinking header names must be lowercase
• Expecting two parameters in after_request function
• Missing quotes around header value string

5. You want to add multiple secure headers in Flask, but only for HTTPS requests. Which is the best way to do this securely and efficiently?

hard

A. Use @app.after_request to check request.is_secure and add headers conditionally

B. Add headers in each route function only if request.scheme == 'https'

C. Set headers globally without checking protocol, assuming HTTPS everywhere

D. Use @app.before_request to add headers before response is created

Solution

1. Step 1: Understand when headers should be added

   Secure headers like Strict-Transport-Security should only be sent over HTTPS to avoid security risks.

2. Step 2: Choose the best place to add headers conditionally

   @app.after_request runs after response creation and can access request.is_secure to conditionally add headers efficiently for all routes.

3. Step 3: Evaluate other options

   Adding headers in each route duplicates code; setting headers globally without checking protocol risks sending them over HTTP; @app.before_request cannot modify response headers.

4. Final Answer:

   Use @app.after_request to check request.is_secure and add headers conditionally -> Option A

5. Quick Check:

   Conditional header addition in @app.after_request is best [OK]

Hint: Check request.is_secure in @app.after_request [OK]

Common Mistakes:

• Adding headers in each route causing repetition
• Sending secure headers over HTTP by default
• Trying to set headers in @app.before_request which can't modify response