Testing authentication flows in Flask - Performance & Optimization

Performance: Testing authentication flows

MEDIUM IMPACT

This affects the speed and responsiveness of user login and session management, impacting user experience during authentication.

Testing user login with real database calls

Flask

from unittest.mock import patch

def test_login(client):
    with patch('app.auth.verify_user') as mock_verify:
        mock_verify.return_value = True
        response = client.post('/login', data={'username': 'user', 'password': 'pass'})
        assert response.status_code == 200

Mocks database calls to avoid slow I/O, making tests faster and more reliable.

📈 Performance Gainreduces test time by 80%+, enabling quick feedback

Testing user login with real database calls

Flask

def test_login(client):
    response = client.post('/login', data={'username': 'user', 'password': 'pass'})
    assert response.status_code == 200
    # Real DB call happens here

Tests make real database calls, slowing down tests and causing delays in feedback.

📉 Performance Costblocks test suite for hundreds of milliseconds per test, slowing development feedback loop

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Real DB calls in tests	N/A (server-side)	N/A	N/A	[X] Bad
Mocked DB calls in tests	N/A (server-side)	N/A	N/A	[OK] Good
Recreate app/client per test	N/A	N/A	N/A	[X] Bad
Reuse app/client fixtures	N/A	N/A	N/A	[OK] Good
Blocking calls in auth flow	N/A	N/A	N/A	[X] Bad
Stub blocking calls in auth	N/A	N/A	N/A	[OK] Good

Rendering Pipeline

Authentication flows impact the interaction responsiveness stage by controlling how quickly the server responds to login requests, which affects the browser's ability to paint the next frame.

→Server Processing

→Network

→Interaction to Next Paint (INP)

⚠️ BottleneckServer Processing due to blocking or slow authentication logic

Core Web Vital Affected

INP

This affects the speed and responsiveness of user login and session management, impacting user experience during authentication.

Optimization Tips

1Mock slow dependencies like databases during authentication tests to speed up feedback.

2Reuse app and client instances across tests to reduce setup overhead.

3Avoid blocking calls in authentication logic to improve responsiveness.

Performance Quiz - 3 Questions

Why is mocking database calls during authentication tests better for performance?

A It increases test coverage automatically

B It avoids slow real database I/O, speeding up tests

C It makes the UI render faster

D It reduces network latency

DevTools: Performance

How to check: Record a performance profile while performing login in the app; look for long server response times or blocking scripts.

What to look for: Look for long tasks or delays in the Interaction to Next Paint (INP) metric indicating slow authentication response.

Practice

1. What is the main purpose of testing authentication flows in a Flask application?

easy

A. To test if the server starts without errors

B. To check if the database connection is working

C. To ensure the UI layout is responsive

D. To verify that only authorized users can access protected routes

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flows control user access to secure parts of the app.

2. Step 2: Identify the goal of testing these flows

   Testing ensures only users with correct credentials can access protected routes.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option D

4. Quick Check:

   Authentication testing = Access control verification [OK]

Hint: Authentication tests check user access rights only [OK]

Common Mistakes:

• Confusing authentication with UI or server startup tests
• Thinking database connection tests are part of authentication
• Assuming authentication tests check layout or styling

2. Which Flask test client method is used to simulate a POST request for login in authentication tests?

easy

A. client.get()

B. client.put()

C. client.post()

D. client.delete()

Solution

1. Step 1: Identify HTTP method for login submission

   Login forms usually send data via POST requests to submit credentials.

2. Step 2: Match Flask test client method

   client.post() simulates POST requests in Flask tests.

3. Final Answer:

   client.post() -> Option C

4. Quick Check:

   POST request for login = client.post() [OK]

Hint: Use client.post() to simulate form submissions [OK]

Common Mistakes:

• Using client.get() for login POST requests
• Confusing HTTP methods like PUT or DELETE for login
• Not passing data with the POST request

3. Given this Flask test code snippet, what will response.status_code be after a successful login?

response = client.post('/login', data={'username': 'user', 'password': 'pass'}, follow_redirects=True)

medium

A. 200

B. 302

C. 404

D. 500

Solution

1. Step 1: Understand follow_redirects=True effect

   Setting follow_redirects=True makes the client follow redirects and return the final page response.

2. Step 2: Determine status code after successful login with redirect

   After login, the app redirects (302) but client follows it, so final response is the redirected page with status 200.

3. Final Answer:

   200 -> Option A

4. Quick Check:

   follow_redirects=True means final status = 200 [OK]

Hint: follow_redirects=True returns final page status 200 [OK]

Common Mistakes:

• Expecting 302 instead of 200 when following redirects
• Confusing 404 or 500 as login response codes
• Ignoring follow_redirects parameter effect

4. Identify the error in this Flask test code for login:

response = client.post('/login', data={'username': 'user'})
assert response.status_code == 200

medium

A. Missing password in data causes login failure

B. Using client.post() instead of client.get()

C. Incorrect assertion; status code should be 404

D. No error; code is correct

Solution

1. Step 1: Check login data completeness

   Login usually requires both username and password; password is missing here.

2. Step 2: Understand impact on response

   Missing password likely causes login failure, so status code 200 may not be returned.

3. Final Answer:

   Missing password in data causes login failure -> Option A

4. Quick Check:

   Login needs username and password [OK]

Hint: Always include all required login fields in test data [OK]

Common Mistakes:

• Assuming client.get() is needed for login POST
• Expecting 404 status code on login failure
• Ignoring missing password field

5. You want to test that a protected route /dashboard redirects unauthorized users to /login. Which test code snippet correctly checks this behavior?

hard

A. response = client.post('/dashboard')
assert response.status_code == 200

B. response = client.get('/dashboard')
assert response.status_code == 302
assert '/login' in response.headers['Location']

C. response = client.get('/dashboard', follow_redirects=True)
assert response.status_code == 404

D. response = client.get('/login')
assert response.status_code == 302

Solution

1. Step 1: Understand protected route behavior

   Unauthorized access to /dashboard should redirect (302) to /login.

2. Step 2: Verify test code matches expected behavior

   client.get('/dashboard') without login returns 302 redirect; Location header includes '/login'.

3. Final Answer:

   response = client.get('/dashboard')\nassert response.status_code == 302\nassert '/login' in response.headers['Location'] -> Option B

4. Quick Check:

   Unauthorized access redirects = status 302 + Location header [OK]

Hint: Check status 302 and Location header for redirects [OK]

Common Mistakes:

• Using POST instead of GET for protected route access
• Expecting 200 status without login
• Checking wrong status code or missing Location header