Bearer token authentication in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Bearer token check?

Given this Python Flask snippet checking a Bearer token, what will be the response if the token is 'abc123'?

Rest API

from flask import Flask, request, jsonify
app = Flask(__name__)

@app.route('/data')
def data():
    auth = request.headers.get('Authorization')
    if auth == 'Bearer abc123':
        return jsonify({'message': 'Access granted'})
    else:
        return jsonify({'message': 'Access denied'}), 401

# Simulate a request with header Authorization: Bearer abc123
response = None
class DummyRequest:
    headers = {'Authorization': 'Bearer abc123'}
request = DummyRequest()

if request.headers.get('Authorization') == 'Bearer abc123':
    response = {'message': 'Access granted'}
else:
    response = {'message': 'Access denied'}

print(response)

A {"message": "Access granted"}

B {"message": "Access denied"}

C 401 Unauthorized error

D None

💡 Hint

Check the exact match of the Authorization header value.

The code checks if the Authorization header exactly matches 'Bearer abc123'. If yes, it returns access granted message.

🧠 Conceptual

intermediate

What does the 'Bearer' keyword signify in the Authorization header?

In the HTTP header 'Authorization: Bearer ', what is the role of the word 'Bearer'?

A It indicates the type of token used for authentication.

B It is the actual token value.

C It specifies the encryption method of the token.

D It is a username prefix.

💡 Hint

Think about how HTTP headers specify token types.

The word 'Bearer' tells the server that the following string is a bearer token used for authentication.

🔧 Debug

advanced

Why does this Bearer token check always fail?

Identify the error in this Python code snippet that checks a Bearer token from headers: headers = {'Authorization': 'Bearer abc123'} token = headers.get('Authorization') if token == 'abc123': print('Access granted') else: print('Access denied')

A The headers dictionary is missing the Authorization key.

B The comparison should use 'Bearer abc123' instead of 'abc123'.

C The token variable includes 'Bearer ' prefix, so direct comparison to 'abc123' fails.

D The code raises a KeyError because get() is not used.

💡 Hint

Check what the token variable actually contains.

The token variable contains 'Bearer abc123', so comparing it directly to 'abc123' fails.

📝 Syntax

advanced

Which option correctly extracts the Bearer token from the Authorization header?

Given a header string 'Authorization: Bearer abc123', which Python code correctly extracts 'abc123'?

A token = header.split(':')[1]

B token = header.replace('Bearer', '')

C token = header[7:]

D token = header.split(' ')[1]

💡 Hint

Split the string by space and take the second part.

Splitting by space and taking index 1 extracts the token after 'Bearer'.

🚀 Application

expert

How many valid tokens are accepted by this Bearer token validation code?

Consider this Python code snippet: valid_tokens = {'token1', 'token2', 'token3'} header = 'Bearer token2' if header.startswith('Bearer '): token = header[7:] if token in valid_tokens: result = 'Access granted' else: result = 'Access denied' else: result = 'No token provided' print(result) How many tokens from the valid_tokens set will result in 'Access granted' if used in the header?

A 0

B 3

C 1

D 2

💡 Hint

All tokens in valid_tokens are accepted if header starts with 'Bearer '.

Any token in valid_tokens after 'Bearer ' prefix grants access, so all 3 tokens are valid.