Session security in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does Flask's session cookie 'secure' flag do?

In Flask, setting the 'secure' flag on session cookies means:

A The cookie expires immediately after the browser closes.

B The cookie is encrypted with a secret key.

C The cookie is only sent over HTTPS connections.

D The cookie is accessible only via JavaScript.

💡 Hint

Think about when cookies are sent over the network.

The 'secure' flag ensures cookies are sent only over HTTPS, protecting them from being sent over unencrypted connections.

❓ component_behavior

intermediate

What happens if Flask's session cookie has 'httponly' set to false?

Consider this Flask configuration:
app.config['SESSION_COOKIE_HTTPONLY'] = false
What is the effect on session security?

A JavaScript can access the session cookie, increasing risk of XSS attacks.

B The session cookie expires immediately.

C The session cookie is only sent over HTTPS.

D The session cookie is encrypted automatically.

💡 Hint

Think about what 'httponly' controls.

Setting 'httponly' to false allows JavaScript to read the cookie, which can expose it to cross-site scripting (XSS) attacks.

❓ state_output

advanced

What is the output of this Flask session code snippet?

Given the Flask route below, what will be the value of session.get('count') after three requests?

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/')
def index():
    session['count'] = session.get('count', 0) + 1
    return str(session['count'])

A 1 on first request, 2 on second, 3 on third

B Always 1 on every request

C Raises a KeyError on first request

D 0 on first request, then 1, then 2

💡 Hint

Sessions store data between requests.

The code increments 'count' in the session each time the route is accessed, so it increases by 1 on each request.

📝 Syntax

advanced

Which Flask session configuration line correctly sets the cookie to expire in 1 hour?

Choose the correct way to set Flask session cookie expiration to 3600 seconds.

A app.config['PERMANENT_SESSION_LIFETIME'] = 3600

B app.config['SESSION_COOKIE_DURATION'] = 3600

C app.config['SESSION_COOKIE_EXPIRE'] = 3600

D app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(seconds=3600)

💡 Hint

Check the type expected for 'PERMANENT_SESSION_LIFETIME'.

Flask expects a timedelta object for 'PERMANENT_SESSION_LIFETIME', not an integer.

🔧 Debug

expert

Why does this Flask app fail to keep session data between requests?

Examine this Flask app snippet:

from flask import Flask, session
app = Flask(__name__)

@app.route('/')
def index():
    session['user'] = 'Alice'
    return 'Set user'

After refreshing the page multiple times, session.get('user') is always null. What is the cause?

A The session cookie is set to secure but the app runs on HTTP.

B The app is missing a secret key, so sessions cannot be signed.

C The session data is cleared explicitly after each request.

D The route does not return the session data.

💡 Hint

Flask sessions require a secret key to work properly.

Without app.secret_key, Flask cannot sign session cookies, so session data is lost between requests.