Why security is critical in Flask - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Flask class.

Flask

from flask import [1]
app = [1](__name__)

Drag options to blanks, or click blank then click option'

Arender_template

BRequest

CFlask

Dredirect

Attempts:

3 left

💡 Hint

Common Mistakes

Importing Request instead of Flask

Using render_template in place of Flask

The Flask class is imported to create the app instance.

2fill in blank

medium

Complete the code to define a route for the home page.

Flask

@app.route('[1]')
def home():
    return 'Welcome to the secure app!'

Drag options to blanks, or click blank then click option'

A/

B/home

C/index.html

D/main

Attempts:

3 left

💡 Hint

Common Mistakes

Using '/home' instead of '/'

Using file names like '/index.html'

The root URL '/' is used for the home page route.

3fill in blank

hard

Fix the error in the code to run the Flask app securely.

Flask

if __name__ == '__main__':
    app.run(debug=[1])

Drag options to blanks, or click blank then click option'

ATrue

BNone

C0

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Leaving debug=True in production

Using None or 0 instead of False

Debug mode should be off (False) in production for security.

4fill in blank

hard

Fill both blanks to protect against Cross-Site Request Forgery (CSRF).

Flask

from flask_wtf import [1]
app.config['SECRET_KEY'] = '[2]'

Drag options to blanks, or click blank then click option'

ACSRFProtect

BFlaskForm

Chard-to-guess-secret-key

DSESSION_COOKIE_SECURE

Attempts:

3 left

💡 Hint

Common Mistakes

Using FlaskForm instead of CSRFProtect for protection

Misconfiguring SECRET_KEY

CSRFProtect enables CSRF protection; SECRET_KEY is needed for security tokens.

5fill in blank

hard

Fill all three blanks to safely handle user input in a Flask route.

Flask

from flask import request, escape

@app.route('/submit', methods=['POST'])
def submit():
    user_input = request.[1].get('[2]')
    safe_input = [3](user_input)
    return f'You entered: {safe_input}'

Drag options to blanks, or click blank then click option'

Aform

Bargs

Cescape

Dusername

Attempts:

3 left

💡 Hint

Common Mistakes

Using request.args for POST data

Not escaping user input

Use request.form to get POST data, 'username' as the input name, and escape() to prevent injection.