Session security in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a secret key for Flask sessions.

Flask

app = Flask(__name__)
app.secret_key = [1]

Drag options to blanks, or click blank then click option'

ANone

B"mysecretkey123"

C12345

DTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using a number or boolean as secret key

Leaving secret_key as None

The secret key must be a string used to sign session cookies securely.

2fill in blank

medium

Complete the code to store a username in the session after login.

Flask

from flask import session

def login():
    session[[1]] = 'user123'

Drag options to blanks, or click blank then click option'

A"password"

B"token"

C"username"

D"user_id"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'password' as session key

Using unrelated keys like 'token'

Storing the username in session under the key 'username' helps identify the logged-in user.

3fill in blank

hard

Fix the error in the code to clear the session on logout.

Flask

from flask import session

def logout():
    [1].clear()

Drag options to blanks, or click blank then click option'

Asession

Brequest

Capp

Dflask

Attempts:

3 left

💡 Hint

Common Mistakes

Calling clear() on request or app instead of session

To clear all session data, call clear() on the session object.

4fill in blank

hard

Fill both blanks to check if a user is logged in by verifying the session key.

Flask

from flask import session

def is_logged_in():
    return [1] in session and session[[2]] is not None

Drag options to blanks, or click blank then click option'

A"username"

B"user"

C"logged_in"

D"token"

Attempts:

3 left

💡 Hint

Common Mistakes

Using different keys for checking presence and value

Using keys unrelated to username

Checking if 'username' exists and is not None in session confirms login status.

5fill in blank

hard

Fill all three blanks to create a secure session cookie with HttpOnly and Secure flags.

Flask

app.config['SESSION_COOKIE_HTTPONLY'] = [1]
app.config['SESSION_COOKIE_SECURE'] = [2]
app.config['SESSION_COOKIE_SAMESITE'] = [3]

Drag options to blanks, or click blank then click option'

ATrue

BFalse

C"Lax"

D"None"

Attempts:

3 left

💡 Hint

Common Mistakes

Setting Secure or HttpOnly to False

Using 'None' for SameSite without HTTPS

Setting HttpOnly and Secure to True helps protect cookies. 'Lax' for SameSite balances security and usability.