Testing authentication flows in Flask - Step-by-Step Execution

Concept Flow - Testing authentication flows

Start Test Setup

↓

Create Test Client

↓

Send Login Request

↓

Check Response Status

↓

Success

↓

Check Session

↓

Logout Request

↓

Check Logout Success

↓

End Test

The test sets up a client, sends login data, checks success or failure, verifies session, logs out, and confirms logout.

Execution Sample

Flask

def test_login(client):
    response = client.post('/login', data={'username': 'user', 'password': 'pass'})
    assert response.status_code == 200
    assert b'Welcome' in response.data
    with client.session_transaction() as sess:
        assert sess['user_id'] == 1

This test sends login data, checks response status and content, then verifies session user_id is set.

Execution Table

Step	Action	Input/Condition	Result	Next Step
1	Create test client	N/A	Client ready to send requests	Send login POST
2	Send POST /login	username='user', password='pass'	Response received with status 200	Check response status
3	Check response status	status_code == 200	True	Check response content
4	Check response content	b'Welcome' in response.data	True	Check session data
5	Access session	session_transaction()	sess['user_id'] == 1	Send logout request
6	Send GET /logout	N/A	Response received with status 302 (redirect)	Check logout success
7	Check logout redirect	status_code == 302	True	End test
8	End test	All assertions passed	Test successful	N/A

💡 Test ends after all assertions pass or fail on any check

Variable Tracker

Variable	Start	After Step 2	After Step 5	After Step 7	Final
client	None	Test client instance	Test client instance	Test client instance	Test client instance
response.status_code	N/A	200	200	302	302
response.data	N/A	HTML with 'Welcome'	HTML with 'Welcome'	Redirect response	Redirect response
sess['user_id']	N/A	N/A	1	1	1

Key Moments - 3 Insights

Why do we check response.status_code before checking response content?

Checking status_code first ensures the request succeeded; if it failed, content checks might be invalid. See execution_table step 3 and 4.

How does client.session_transaction() help in testing?

It lets us access and verify session data like user_id during the test, as shown in step 5 of execution_table.

Why is logout response status 302 instead of 200?

Logout usually redirects to another page, so status 302 means redirect success, as seen in step 6 and 7.

Visual Quiz - 3 Questions

Look at the execution_table, what is the response.status_code after sending the login POST request?

A 200

B 302

C 404

D 500

💡 Hint

Check step 2 in the execution_table where the POST /login response is received.

At which step does the test verify the session contains the user_id?

A Step 3

B Step 5

C Step 6

D Step 7

💡 Hint

Look at execution_table step 5 where session_transaction() is used.

If the login POST returned status 401, what would happen in the test flow?

A Test would continue to check session

B Test would fail at response.status_code check

C Test would skip logout

D Test would pass anyway

💡 Hint

Refer to step 3 where status_code must be 200 to proceed.

Concept Snapshot

Testing authentication flows in Flask:
- Use test client to send POST /login with credentials
- Check response status and content for success
- Access session with client.session_transaction() to verify login
- Send GET /logout and check redirect status
- Assert all expected behaviors to confirm flow works

Full Transcript

This visual execution trace shows how to test authentication flows in Flask. First, a test client is created to simulate browser requests. Then, a POST request is sent to the login route with username and password. The test checks if the response status code is 200, meaning success. Next, it verifies the response content includes a welcome message. Using session_transaction, the test accesses the session to confirm the user_id is set, indicating a logged-in user. Afterwards, a logout request is sent, and the test checks for a redirect status code 302, confirming logout success. The test ends after all assertions pass, ensuring the authentication flow works as expected.

Practice

1. What is the main purpose of testing authentication flows in a Flask application?

easy

A. To test if the server starts without errors

B. To check if the database connection is working

C. To ensure the UI layout is responsive

D. To verify that only authorized users can access protected routes

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flows control user access to secure parts of the app.

2. Step 2: Identify the goal of testing these flows

   Testing ensures only users with correct credentials can access protected routes.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option D

4. Quick Check:

   Authentication testing = Access control verification [OK]

Hint: Authentication tests check user access rights only [OK]

Common Mistakes:

• Confusing authentication with UI or server startup tests
• Thinking database connection tests are part of authentication
• Assuming authentication tests check layout or styling

2. Which Flask test client method is used to simulate a POST request for login in authentication tests?

easy

A. client.get()

B. client.put()

C. client.post()

D. client.delete()

Solution

1. Step 1: Identify HTTP method for login submission

   Login forms usually send data via POST requests to submit credentials.

2. Step 2: Match Flask test client method

   client.post() simulates POST requests in Flask tests.

3. Final Answer:

   client.post() -> Option C

4. Quick Check:

   POST request for login = client.post() [OK]

Hint: Use client.post() to simulate form submissions [OK]

Common Mistakes:

• Using client.get() for login POST requests
• Confusing HTTP methods like PUT or DELETE for login
• Not passing data with the POST request

3. Given this Flask test code snippet, what will response.status_code be after a successful login?

response = client.post('/login', data={'username': 'user', 'password': 'pass'}, follow_redirects=True)

medium

A. 200

B. 302

C. 404

D. 500

Solution

1. Step 1: Understand follow_redirects=True effect

   Setting follow_redirects=True makes the client follow redirects and return the final page response.

2. Step 2: Determine status code after successful login with redirect

   After login, the app redirects (302) but client follows it, so final response is the redirected page with status 200.

3. Final Answer:

   200 -> Option A

4. Quick Check:

   follow_redirects=True means final status = 200 [OK]

Hint: follow_redirects=True returns final page status 200 [OK]

Common Mistakes:

• Expecting 302 instead of 200 when following redirects
• Confusing 404 or 500 as login response codes
• Ignoring follow_redirects parameter effect

4. Identify the error in this Flask test code for login:

response = client.post('/login', data={'username': 'user'})
assert response.status_code == 200

medium

A. Missing password in data causes login failure

B. Using client.post() instead of client.get()

C. Incorrect assertion; status code should be 404

D. No error; code is correct

Solution

1. Step 1: Check login data completeness

   Login usually requires both username and password; password is missing here.

2. Step 2: Understand impact on response

   Missing password likely causes login failure, so status code 200 may not be returned.

3. Final Answer:

   Missing password in data causes login failure -> Option A

4. Quick Check:

   Login needs username and password [OK]

Hint: Always include all required login fields in test data [OK]

Common Mistakes:

• Assuming client.get() is needed for login POST
• Expecting 404 status code on login failure
• Ignoring missing password field

5. You want to test that a protected route /dashboard redirects unauthorized users to /login. Which test code snippet correctly checks this behavior?

hard

A. response = client.post('/dashboard')
assert response.status_code == 200

B. response = client.get('/dashboard')
assert response.status_code == 302
assert '/login' in response.headers['Location']

C. response = client.get('/dashboard', follow_redirects=True)
assert response.status_code == 404

D. response = client.get('/login')
assert response.status_code == 302

Solution

1. Step 1: Understand protected route behavior

   Unauthorized access to /dashboard should redirect (302) to /login.

2. Step 2: Verify test code matches expected behavior

   client.get('/dashboard') without login returns 302 redirect; Location header includes '/login'.

3. Final Answer:

   response = client.get('/dashboard')\nassert response.status_code == 302\nassert '/login' in response.headers['Location'] -> Option B

4. Quick Check:

   Unauthorized access redirects = status 302 + Location header [OK]

Hint: Check status 302 and Location header for redirects [OK]

Common Mistakes:

• Using POST instead of GET for protected route access
• Expecting 200 status without login
• Checking wrong status code or missing Location header