Testing authentication flows in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Flask testing client.

Flask

from flask import Flask
from flask.testing import [1]

Drag options to blanks, or click blank then click option'

ATestClient

BFlaskClient

CClient

DTestCase

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'TestClient' which is not the correct Flask class.

Importing 'TestCase' instead of the client.

The Flask testing client is imported as FlaskClient from flask.testing.

2fill in blank

medium

Complete the code to create a test client from the Flask app.

Flask

app = Flask(__name__)
client = app.[1]()

Drag options to blanks, or click blank then click option'

Atest_client

Bcreate_client

Cclient

Dtest

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'create_client' which is not a Flask method.

Using 'client' which is just a variable name.

The method to create a test client in Flask is test_client().

3fill in blank

hard

Fix the error in the test login POST request code.

Flask

response = client.post('/login', data=[1], follow_redirects=True)

Drag options to blanks, or click blank then click option'

A'username=user&password=pass'

B['username', 'user', 'password', 'pass']

C{'username': 'user', 'password': 'pass'}

D('username', 'user', 'password', 'pass')

Attempts:

3 left

💡 Hint

Common Mistakes

Passing a list or tuple instead of a dictionary.

Passing a URL-encoded string instead of a dict.

The data argument expects a dictionary with form keys and values.

4fill in blank

hard

Fill both blanks to check if the login response contains the welcome message.

Flask

assert [1] in response.data.decode('utf-8') and response.status_code == [2]

Drag options to blanks, or click blank then click option'

A'Welcome, user!'

B200

C404

D'Login failed'

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for 'Login failed' instead of the welcome message.

Using status code 404 which means not found.

The response should contain the welcome message string and have status code 200 for success.

5fill in blank

hard

Fill all three blanks to test logout and verify redirection status code.

Flask

logout_response = client.get('/logout', follow_redirects=[1])
assert logout_response.status_code == [2]
assert '[3]' in logout_response.data.decode('utf-8')

Drag options to blanks, or click blank then click option'

ATrue

B302

C'Login Page'

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting follow_redirects to False and missing the redirect.

Checking for wrong status codes or page content.

Follow redirects should be True to follow the logout redirect. The status code 302 means redirect. The login page text confirms logout success.

Practice

1. What is the main purpose of testing authentication flows in a Flask application?

easy

A. To test if the server starts without errors

B. To check if the database connection is working

C. To ensure the UI layout is responsive

D. To verify that only authorized users can access protected routes

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flows control user access to secure parts of the app.

2. Step 2: Identify the goal of testing these flows

   Testing ensures only users with correct credentials can access protected routes.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option D

4. Quick Check:

   Authentication testing = Access control verification [OK]

Hint: Authentication tests check user access rights only [OK]

Common Mistakes:

• Confusing authentication with UI or server startup tests
• Thinking database connection tests are part of authentication
• Assuming authentication tests check layout or styling

2. Which Flask test client method is used to simulate a POST request for login in authentication tests?

easy

A. client.get()

B. client.put()

C. client.post()

D. client.delete()

Solution

1. Step 1: Identify HTTP method for login submission

   Login forms usually send data via POST requests to submit credentials.

2. Step 2: Match Flask test client method

   client.post() simulates POST requests in Flask tests.

3. Final Answer:

   client.post() -> Option C

4. Quick Check:

   POST request for login = client.post() [OK]

Hint: Use client.post() to simulate form submissions [OK]

Common Mistakes:

• Using client.get() for login POST requests
• Confusing HTTP methods like PUT or DELETE for login
• Not passing data with the POST request

3. Given this Flask test code snippet, what will response.status_code be after a successful login?

response = client.post('/login', data={'username': 'user', 'password': 'pass'}, follow_redirects=True)

medium

A. 200

B. 302

C. 404

D. 500

Solution

1. Step 1: Understand follow_redirects=True effect

   Setting follow_redirects=True makes the client follow redirects and return the final page response.

2. Step 2: Determine status code after successful login with redirect

   After login, the app redirects (302) but client follows it, so final response is the redirected page with status 200.

3. Final Answer:

   200 -> Option A

4. Quick Check:

   follow_redirects=True means final status = 200 [OK]

Hint: follow_redirects=True returns final page status 200 [OK]

Common Mistakes:

• Expecting 302 instead of 200 when following redirects
• Confusing 404 or 500 as login response codes
• Ignoring follow_redirects parameter effect

4. Identify the error in this Flask test code for login:

response = client.post('/login', data={'username': 'user'})
assert response.status_code == 200

medium

A. Missing password in data causes login failure

B. Using client.post() instead of client.get()

C. Incorrect assertion; status code should be 404

D. No error; code is correct

Solution

1. Step 1: Check login data completeness

   Login usually requires both username and password; password is missing here.

2. Step 2: Understand impact on response

   Missing password likely causes login failure, so status code 200 may not be returned.

3. Final Answer:

   Missing password in data causes login failure -> Option A

4. Quick Check:

   Login needs username and password [OK]

Hint: Always include all required login fields in test data [OK]

Common Mistakes:

• Assuming client.get() is needed for login POST
• Expecting 404 status code on login failure
• Ignoring missing password field

5. You want to test that a protected route /dashboard redirects unauthorized users to /login. Which test code snippet correctly checks this behavior?

hard

A. response = client.post('/dashboard')
assert response.status_code == 200

B. response = client.get('/dashboard')
assert response.status_code == 302
assert '/login' in response.headers['Location']

C. response = client.get('/dashboard', follow_redirects=True)
assert response.status_code == 404

D. response = client.get('/login')
assert response.status_code == 302

Solution

1. Step 1: Understand protected route behavior

   Unauthorized access to /dashboard should redirect (302) to /login.

2. Step 2: Verify test code matches expected behavior

   client.get('/dashboard') without login returns 302 redirect; Location header includes '/login'.

3. Final Answer:

   response = client.get('/dashboard')\nassert response.status_code == 302\nassert '/login' in response.headers['Location'] -> Option B

4. Quick Check:

   Unauthorized access redirects = status 302 + Location header [OK]

Hint: Check status 302 and Location header for redirects [OK]

Common Mistakes:

• Using POST instead of GET for protected route access
• Expecting 200 status without login
• Checking wrong status code or missing Location header