Testing authentication flows in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a logged-out user accesses a protected route?

Consider a Flask app with a login_required decorator protecting the /dashboard route. What happens when a user who is not logged in tries to access /dashboard?

Flask

from flask import Flask, redirect, url_for
from flask_login import LoginManager, login_required

app = Flask(__name__)
login_manager = LoginManager(app)

@login_manager.unauthorized_handler
def unauthorized():
    return redirect(url_for('login'))

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard!'

@app.route('/login')
def login():
    return 'Please log in.'

A The user is redirected to the /login page and sees 'Please log in.'

B The user sees 'Welcome to your dashboard!'

C The user gets a 404 Not Found error

D The user sees a blank page with status 200

💡 Hint

Think about what the login_required decorator does when the user is not authenticated.

The login_required decorator checks if the user is logged in. If not, it calls the unauthorized_handler which redirects the user to the login page. So the user sees the login page content.

❓ state_output

intermediate

What is the session state after a successful login?

In a Flask app using flask_login, after calling login_user(user), what key is added to the session to track the logged-in user?

Flask

from flask import Flask, session
from flask_login import LoginManager, login_user, UserMixin

app = Flask(__name__)
app.secret_key = 'secret'
login_manager = LoginManager(app)

class User(UserMixin):
    def __init__(self, id):
        self.id = id

user = User('123')

with app.test_request_context():
    login_user(user)
    user_id_in_session = session.get('_user_id')

A 'current_user'

B 'user_id'

C '_user_id'

D 'logged_in_user'

💡 Hint

Check flask_login's source or documentation for the session key it uses.

Flask-Login stores the logged-in user's ID in the session under the key _user_id. This is how it remembers who is logged in across requests.

📝 Syntax

advanced

Which code snippet correctly tests login with Flask's test client?

You want to test logging in a user by posting credentials to /login using Flask's test client. Which snippet correctly performs the login and checks the response?

Flask

from flask import Flask, request
from flask_login import LoginManager, login_user, UserMixin

app = Flask(__name__)
app.secret_key = 'secret'
login_manager = LoginManager(app)

class User(UserMixin):
    def __init__(self, id):
        self.id = id

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    if username == 'testuser':
        user = User('1')
        login_user(user)
        return 'Logged in'
    return 'Failed', 401

client = app.test_client()

A

response = client.post('/login', json={'username': 'testuser'})
assert response.data == b'Logged in'

B

response = client.post('/login', data='username=testuser')
assert response.data == b'Logged in'

C

response = client.get('/login', data={'username': 'testuser'})
assert response.status_code == 200

D

response = client.post('/login', data={'username': 'testuser'})
assert response.data == b'Logged in'

💡 Hint

Remember how form data is sent in POST requests with Flask test client.

The Flask test client sends form data with the data argument as a dictionary. Using json sends JSON, which the route does not expect. GET requests do not send form data in the body.

🔧 Debug

advanced

Why does this test fail to detect a logged-in user?

A test posts login data and then requests a protected page but gets redirected to login again. Why?

Flask

response = client.post('/login', data={'username': 'testuser'})
response = client.get('/dashboard')
assert b'Welcome' in response.data

A The test client does not preserve cookies between requests by default

B The test client needs to use follow_redirects=True on the get request

C The /dashboard route is not decorated with login_required

D The login route does not set the session cookie properly

💡 Hint

Think about what happens when a protected route redirects to login.

When accessing a protected route without being logged in, Flask-Login redirects to the login page. The test client must follow redirects to get the final page content. Without follow_redirects=True, the response is the redirect itself, not the dashboard content.

🧠 Conceptual

expert

What is the best way to test logout behavior in Flask-Login?

You want to test that after logging out, the user cannot access protected routes. Which approach correctly verifies this?

A Call client.get('/logout') then client.get('/dashboard', follow_redirects=True) and check the response contains the login page content

B Call client.get('/logout') then client.get('/dashboard') and check the status code is 200

C Call client.post('/logout') then client.get('/dashboard') and check the response data is empty

D Call client.get('/logout') then client.get('/dashboard') and check the response status code is 404

💡 Hint

Think about what happens after logout and how protected routes behave.

After logout, the user is no longer authenticated. Accessing a protected route redirects to login. Using follow_redirects=True lets the test client get the login page content to verify the user is logged out.

Practice

1. What is the main purpose of testing authentication flows in a Flask application?

easy

A. To test if the server starts without errors

B. To check if the database connection is working

C. To ensure the UI layout is responsive

D. To verify that only authorized users can access protected routes

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flows control user access to secure parts of the app.

2. Step 2: Identify the goal of testing these flows

   Testing ensures only users with correct credentials can access protected routes.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option D

4. Quick Check:

   Authentication testing = Access control verification [OK]

Hint: Authentication tests check user access rights only [OK]

Common Mistakes:

• Confusing authentication with UI or server startup tests
• Thinking database connection tests are part of authentication
• Assuming authentication tests check layout or styling

2. Which Flask test client method is used to simulate a POST request for login in authentication tests?

easy

A. client.get()

B. client.put()

C. client.post()

D. client.delete()

Solution

1. Step 1: Identify HTTP method for login submission

   Login forms usually send data via POST requests to submit credentials.

2. Step 2: Match Flask test client method

   client.post() simulates POST requests in Flask tests.

3. Final Answer:

   client.post() -> Option C

4. Quick Check:

   POST request for login = client.post() [OK]

Hint: Use client.post() to simulate form submissions [OK]

Common Mistakes:

• Using client.get() for login POST requests
• Confusing HTTP methods like PUT or DELETE for login
• Not passing data with the POST request

3. Given this Flask test code snippet, what will response.status_code be after a successful login?

response = client.post('/login', data={'username': 'user', 'password': 'pass'}, follow_redirects=True)

medium

A. 200

B. 302

C. 404

D. 500

Solution

1. Step 1: Understand follow_redirects=True effect

   Setting follow_redirects=True makes the client follow redirects and return the final page response.

2. Step 2: Determine status code after successful login with redirect

   After login, the app redirects (302) but client follows it, so final response is the redirected page with status 200.

3. Final Answer:

   200 -> Option A

4. Quick Check:

   follow_redirects=True means final status = 200 [OK]

Hint: follow_redirects=True returns final page status 200 [OK]

Common Mistakes:

• Expecting 302 instead of 200 when following redirects
• Confusing 404 or 500 as login response codes
• Ignoring follow_redirects parameter effect

4. Identify the error in this Flask test code for login:

response = client.post('/login', data={'username': 'user'})
assert response.status_code == 200

medium

A. Missing password in data causes login failure

B. Using client.post() instead of client.get()

C. Incorrect assertion; status code should be 404

D. No error; code is correct

Solution

1. Step 1: Check login data completeness

   Login usually requires both username and password; password is missing here.

2. Step 2: Understand impact on response

   Missing password likely causes login failure, so status code 200 may not be returned.

3. Final Answer:

   Missing password in data causes login failure -> Option A

4. Quick Check:

   Login needs username and password [OK]

Hint: Always include all required login fields in test data [OK]

Common Mistakes:

• Assuming client.get() is needed for login POST
• Expecting 404 status code on login failure
• Ignoring missing password field

5. You want to test that a protected route /dashboard redirects unauthorized users to /login. Which test code snippet correctly checks this behavior?

hard

A. response = client.post('/dashboard')
assert response.status_code == 200

B. response = client.get('/dashboard')
assert response.status_code == 302
assert '/login' in response.headers['Location']

C. response = client.get('/dashboard', follow_redirects=True)
assert response.status_code == 404

D. response = client.get('/login')
assert response.status_code == 302

Solution

1. Step 1: Understand protected route behavior

   Unauthorized access to /dashboard should redirect (302) to /login.

2. Step 2: Verify test code matches expected behavior

   client.get('/dashboard') without login returns 302 redirect; Location header includes '/login'.

3. Final Answer:

   response = client.get('/dashboard')\nassert response.status_code == 302\nassert '/login' in response.headers['Location'] -> Option B

4. Quick Check:

   Unauthorized access redirects = status 302 + Location header [OK]

Hint: Check status 302 and Location header for redirects [OK]

Common Mistakes:

• Using POST instead of GET for protected route access
• Expecting 200 status without login
• Checking wrong status code or missing Location header