Why API security is non-negotiable in Rest API - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add an API key check in the request headers.

Rest API

if request.headers.get('[1]') != 'my_secret_key':
    return {'error': 'Unauthorized'}, 401

Drag options to blanks, or click blank then click option'

AApi-Key

BAuthorization

CContent-Type

DUser-Agent

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Authorization' or 'Content-Type' instead of 'Api-Key'.

The API key is usually sent in the 'Api-Key' header to authenticate requests.

2fill in blank

medium

Complete the code to enforce HTTPS for API requests.

Rest API

if not request.url.startswith('[1]'):
    return {'error': 'Use HTTPS'}, 403

Drag options to blanks, or click blank then click option'

Aws://

Bhttps://

Cftp://

Dhttp://

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http://' which is not secure.

HTTPS ensures encrypted communication, which is essential for API security.

3fill in blank

hard

Fix the error in the code to correctly parse JSON data from the API request.

Rest API

data = request.[1]()

Drag options to blanks, or click blank then click option'

Aparse_json

Bjson

Cjsonify

Dget_json

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'json' which is an attribute, not a method.

Using 'jsonify' which is for creating JSON responses.

In many frameworks, 'get_json()' is the method to parse JSON from the request body.

4fill in blank

hard

Fill both blanks to create a rate limiter that allows 100 requests per minute.

Rest API

limiter = RateLimiter([1]=100, [2]=60)

Drag options to blanks, or click blank then click option'

Amax_requests

Bduration

Cinterval

Dlimit

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'duration' with 'interval'.

Using 'limit' instead of 'max_requests'.

'max_requests' sets the allowed requests, and 'interval' sets the time window in seconds.

5fill in blank

hard

Fill all three blanks to create a secure API endpoint that requires authentication and returns JSON.

Rest API

@app.route('/data')
@[1]
def get_data():
    data = fetch_data()
    return [2](data), [3]

Drag options to blanks, or click blank then click option'

Alogin_required

Bjsonify

C200

Dauthenticate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'authenticate' instead of a decorator.

Returning raw data without 'jsonify'.

'login_required' decorator enforces authentication, 'jsonify' formats the response as JSON, and '200' is the HTTP success status code.