Why security is critical in Flask - See It in Action

Why Security is Critical in Flask

📖 Scenario: You are building a simple Flask web application that handles user login. Security is very important to protect user data and prevent unauthorized access.

🎯 Goal: Build a basic Flask app with a user dictionary, a configuration for a secret key, a login route that checks credentials, and enable session management to keep users logged in securely.

📋 What You'll Learn

Create a dictionary called users with exact username-password pairs

Add a configuration variable SECRET_KEY for session security

Implement a login route that checks username and password from users

Use Flask's session to store login state securely

💡 Why This Matters

🌍 Real World

Web applications need to protect user data and prevent unauthorized access. Using sessions and secret keys helps keep user login information safe.

💼 Career

Understanding how to secure web apps with Flask is essential for backend developers and anyone building user authentication systems.

1

DATA SETUP: Create user data

Create a dictionary called users with these exact entries: 'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'.

Flask

# Your code here

Need a hint?

Use a Python dictionary with usernames as keys and passwords as values.

2

CONFIGURATION: Add Flask secret key

Add a configuration variable SECRET_KEY to the Flask app with the value 'supersecretkey'.

Flask

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
from flask import Flask
app = Flask(__name__)
# Set the secret key for session security
# Your code here

Need a hint?

Use app.config['SECRET_KEY'] = 'supersecretkey' to set the secret key.

3

CORE LOGIC: Create login route

Create a Flask route /login that accepts POST requests. Inside, get username and password from request.form. Check if username is in users and the password matches. If yes, set session['user'] = username.

Flask

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
from flask import Flask
app = Flask(__name__)
app.config['SECRET_KEY'] = 'supersecretkey'
from flask import request, session

# Create /login route to check credentials and set session
# Your code here

Need a hint?

Use @app.route with methods=['POST']. Use request.form.get() to get form data. Use session to store the logged-in user.

4

COMPLETION: Enable session management

Import session from flask and ensure the Flask app uses the SECRET_KEY to enable secure sessions. Confirm the /login route sets session['user'] on successful login.

Flask

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
from flask import Flask
app = Flask(__name__)
app.config['SECRET_KEY'] = 'supersecretkey'
from flask import request, session

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    if username in users and users[username] == password:
        session['user'] = username
        return 'Logged in successfully'
    return 'Invalid credentials', 401

# Finalize session management
# Your code here

Need a hint?

Make sure session is imported and used with the secret key set.