Testing authentication flows in Flask - Mini Project: Build & Apply

Testing authentication flows

📖 Scenario: You are building a simple Flask web app that requires users to log in. You want to write tests to check if the login and logout processes work correctly.

🎯 Goal: Create a test suite using Flask's test client to verify the authentication flow: logging in with correct credentials, failing with wrong credentials, and logging out.

📋 What You'll Learn

Create a Flask app with a login route and a logout route

Set up a test client for the Flask app

Write a test to check successful login with username 'user' and password 'pass'

Write a test to check login failure with wrong password

Write a test to check logout clears the session

💡 Why This Matters

🌍 Real World

Testing authentication flows is essential to ensure users can securely log in and out of web applications without errors.

💼 Career

Many web developer and QA roles require writing tests for user authentication to maintain app security and reliability.

1

Set up Flask app with login and logout routes

Create a Flask app instance called app. Define a route /login that accepts POST requests and checks if the form data has username equal to 'user' and password equal to 'pass'. If correct, set session['logged_in'] = True and return 'Logged in'. Otherwise, return 'Failed'. Also define a route /logout that clears the session and returns 'Logged out'.

Flask

# Your code here to create Flask app with /login and /logout routes

Hint

Use Flask(__name__) to create the app. Use @app.route decorators for routes. Use session to store login state.

2

Set up Flask test client

Create a variable called client by calling app.test_client(). This will be used to send test requests to your Flask app.

Flask

from flask import Flask, request, session

app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    if username == 'user' and password == 'pass':
        session['logged_in'] = True
        return 'Logged in'
    return 'Failed'

@app.route('/logout')
def logout():
    session.clear()
    return 'Logged out'

# Create test client
# Your code here

Hint

Use app.test_client() to create the test client.

3

Write test for successful login

Use the client to send a POST request to /login with form data {'username': 'user', 'password': 'pass'}. Store the response in a variable called response. Then check if b'Logged in' is in response.data.

Flask

response = client.post('/login', data={'username': 'user', 'password': 'pass'})
assert b'Logged in' in response.data
# Test failed login and logout

Hint

Use client.post with data= for form data. Check response.data for the expected bytes.

4

Write tests for failed login and logout

Write a test that sends a POST request to /login with wrong password {'username': 'user', 'password': 'wrong'} and checks that b'Failed' is in the response data. Then send a GET request to /logout and check that b'Logged out' is in the response data.

Flask

Hint

Use client.post with wrong password and check for failure message. Use client.get for logout and check for logout message.

Practice

1. What is the main purpose of testing authentication flows in a Flask application?

easy

A. To test if the server starts without errors

B. To check if the database connection is working

C. To ensure the UI layout is responsive

D. To verify that only authorized users can access protected routes

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flows control user access to secure parts of the app.

2. Step 2: Identify the goal of testing these flows

   Testing ensures only users with correct credentials can access protected routes.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option D

4. Quick Check:

   Authentication testing = Access control verification [OK]

Hint: Authentication tests check user access rights only [OK]

Common Mistakes:

• Confusing authentication with UI or server startup tests
• Thinking database connection tests are part of authentication
• Assuming authentication tests check layout or styling

2. Which Flask test client method is used to simulate a POST request for login in authentication tests?

easy

A. client.get()

B. client.put()

C. client.post()

D. client.delete()

Solution

1. Step 1: Identify HTTP method for login submission

   Login forms usually send data via POST requests to submit credentials.

2. Step 2: Match Flask test client method

   client.post() simulates POST requests in Flask tests.

3. Final Answer:

   client.post() -> Option C

4. Quick Check:

   POST request for login = client.post() [OK]

Hint: Use client.post() to simulate form submissions [OK]

Common Mistakes:

• Using client.get() for login POST requests
• Confusing HTTP methods like PUT or DELETE for login
• Not passing data with the POST request

3. Given this Flask test code snippet, what will response.status_code be after a successful login?

response = client.post('/login', data={'username': 'user', 'password': 'pass'}, follow_redirects=True)

medium

A. 200

B. 302

C. 404

D. 500

Solution

1. Step 1: Understand follow_redirects=True effect

   Setting follow_redirects=True makes the client follow redirects and return the final page response.

2. Step 2: Determine status code after successful login with redirect

   After login, the app redirects (302) but client follows it, so final response is the redirected page with status 200.

3. Final Answer:

   200 -> Option A

4. Quick Check:

   follow_redirects=True means final status = 200 [OK]

Hint: follow_redirects=True returns final page status 200 [OK]

Common Mistakes:

• Expecting 302 instead of 200 when following redirects
• Confusing 404 or 500 as login response codes
• Ignoring follow_redirects parameter effect

4. Identify the error in this Flask test code for login:

response = client.post('/login', data={'username': 'user'})
assert response.status_code == 200

medium

A. Missing password in data causes login failure

B. Using client.post() instead of client.get()

C. Incorrect assertion; status code should be 404

D. No error; code is correct

Solution

1. Step 1: Check login data completeness

   Login usually requires both username and password; password is missing here.

2. Step 2: Understand impact on response

   Missing password likely causes login failure, so status code 200 may not be returned.

3. Final Answer:

   Missing password in data causes login failure -> Option A

4. Quick Check:

   Login needs username and password [OK]

Hint: Always include all required login fields in test data [OK]

Common Mistakes:

• Assuming client.get() is needed for login POST
• Expecting 404 status code on login failure
• Ignoring missing password field

5. You want to test that a protected route /dashboard redirects unauthorized users to /login. Which test code snippet correctly checks this behavior?

hard

A. response = client.post('/dashboard')
assert response.status_code == 200

B. response = client.get('/dashboard')
assert response.status_code == 302
assert '/login' in response.headers['Location']

C. response = client.get('/dashboard', follow_redirects=True)
assert response.status_code == 404

D. response = client.get('/login')
assert response.status_code == 302

Solution

1. Step 1: Understand protected route behavior

   Unauthorized access to /dashboard should redirect (302) to /login.

2. Step 2: Verify test code matches expected behavior

   client.get('/dashboard') without login returns 302 redirect; Location header includes '/login'.

3. Final Answer:

   response = client.get('/dashboard')\nassert response.status_code == 302\nassert '/login' in response.headers['Location'] -> Option B

4. Quick Check:

   Unauthorized access redirects = status 302 + Location header [OK]

Hint: Check status 302 and Location header for redirects [OK]

Common Mistakes:

• Using POST instead of GET for protected route access
• Expecting 200 status without login
• Checking wrong status code or missing Location header