Secure headers configuration in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask response header configuration?

Consider this Flask route that sets security headers. What headers will the client receive?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hello')
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response

A {"X-Frame-Options": "DENY", "Content-Security-Policy": "default-src 'self'"}

B {"X-Frame-Options": "SAMEORIGIN", "Content-Security-Policy": "default-src 'none'"}

C {"X-Content-Type-Options": "nosniff", "Content-Security-Policy": "default-src 'self'"}

D {"X-Frame-Options": "ALLOWALL", "Content-Security-Policy": "default-src 'self'"}

💡 Hint

Look at the exact header keys and values set in the code.

The code sets X-Frame-Options to DENY and Content-Security-Policy to default-src 'self'. So the client receives these exact headers.

📝 Syntax

intermediate

Which option causes a syntax error in Flask header setting?

Identify which code snippet will cause a syntax error when setting headers in Flask.

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hi')
    # Header setting line below
    # Replace with one of the options
    return response

A response.headers['Content-Security-Policy'] = default-src 'self'

B response.headers['X-Content-Type-Options'] = 'nosniff'

C response.headers['X-Frame-Options'] = 'DENY'

D response.headers['Referrer-Policy'] = 'no-referrer'

💡 Hint

Check if the header value is a valid Python string.

Option A misses quotes around the string value, causing a syntax error. It should be a string literal.

❓ state_output

advanced

What is the value of the 'Strict-Transport-Security' header after this Flask middleware runs?

This Flask middleware adds a security header. What is the header's value after a request?

Flask

from flask import Flask, request
app = Flask(__name__)

@app.after_request
def add_hsts_header(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

@app.route('/')
def index():
    return 'Secure site'

A 'max-age=31536000'

B 'max-age=0; includeSubDomains'

C No 'Strict-Transport-Security' header is set

D 'max-age=31536000; includeSubDomains'

💡 Hint

Look at the exact string assigned to the header in the middleware.

The middleware sets the header to 'max-age=31536000; includeSubDomains' on every response.

🔧 Debug

advanced

Why does this Flask app fail to set the 'X-Content-Type-Options' header?

Given this Flask code, why is the 'X-Content-Type-Options' header missing in the response?

Flask

from flask import Flask, make_response
app = Flask(__name__)

@app.route('/')
def index():
    response = make_response('Hello')
    response.headers.add('X-Content-Type-Options', 'nosniff')
    return 'Hello World!'

A The header name is misspelled, so it is ignored

B The header is added but the returned value is a string, not the response object

C Flask does not allow setting 'X-Content-Type-Options' header

D The response.headers.add method does not exist

💡 Hint

Check what the route function returns.

The function returns a string instead of the response object with headers set, so headers are lost.

🧠 Conceptual

expert

Which header configuration best prevents clickjacking attacks in Flask?

Choose the header setting that most effectively prevents clickjacking.

A response.headers['X-Frame-Options'] = 'DENY'

B response.headers['X-Content-Type-Options'] = 'nosniff'

C response.headers['Content-Security-Policy'] = "frame-ancestors 'none'"

D response.headers['Referrer-Policy'] = 'no-referrer'

💡 Hint

Both 'X-Frame-Options' and 'Content-Security-Policy' can control framing, but one is more modern and flexible.

While 'X-Frame-Options: DENY' blocks all framing, 'Content-Security-Policy: frame-ancestors 'none'' is a modern, more flexible way to prevent clickjacking and is recommended.