Why security is critical in Flask - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is input validation important in Flask apps?

In Flask, why should you always validate user input before processing it?

A To reduce the size of the app's code

B To make the app run faster by skipping checks

C To allow users to enter any data without restrictions

D To prevent attackers from sending harmful data that can break the app or steal data

💡 Hint

Think about what happens if bad data reaches your app unchecked.

Validating input helps stop harmful data like scripts or SQL commands that attackers might use to harm your app or steal information.

❓ component_behavior

intermediate

What happens if you don't use CSRF protection in Flask forms?

Consider a Flask app with forms but no CSRF protection. What risk does this create?

A Users will see error messages on every form submission

B The app will crash when users submit forms

C Attackers can trick users into submitting unwanted actions without their knowledge

D Forms will not send any data to the server

💡 Hint

Think about what CSRF stands for and what it protects against.

Without CSRF protection, attackers can create fake requests that look like they come from users, causing unwanted actions like changing passwords or making purchases.

🔧 Debug

advanced

Identify the security flaw in this Flask route code

What security issue does this Flask route have?

Flask

from flask import Flask, request
app = Flask(__name__)

@app.route('/delete', methods=['POST'])
def delete_item():
    item_id = request.form['id']
    # Deletes item without checking user permissions
    delete_from_db(item_id)
    return 'Deleted'

A It deletes items without verifying if the user is allowed to delete them

B It returns a string instead of JSON

C It does not check if item_id is an integer

D It uses POST method which is insecure

💡 Hint

Think about what could happen if anyone can call this route.

The route deletes items without checking if the user has permission. This can let attackers delete data they shouldn't.

📝 Syntax

advanced

Which Flask code snippet correctly sets a secure cookie?

Choose the code that sets a cookie with security best practices in Flask.

A response.set_cookie('session', 'abc123', httponly=False, secure=False)

B response.set_cookie('session', 'abc123', httponly=True, secure=True, samesite='Lax')

C response.set_cookie('session', 'abc123')

D response.set_cookie('session', 'abc123', expires='never')

💡 Hint

Think about cookie flags that protect against theft and cross-site attacks.

Setting httponly, secure, and samesite flags helps protect cookies from being stolen or sent in unsafe ways.

❓ state_output

expert

What is the output after running this Flask session code?

Given this Flask code snippet, what will be the value of session['count'] after two requests?

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/')
def index():
    session['count'] = session.get('count', 0) + 1
    return str(session['count'])

# Assume two requests are made by the same client in order.

A "2"

B "1"

C KeyError because 'count' is missing

D "0"

💡 Hint

Remember Flask sessions keep data between requests for the same client.

The first request sets count to 1, the second increments it to 2, so the output is "2".