Session role client-writable

Code reviewSecurityMid–Senior~25 min

Review this Python (Flask) login handler.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1@app.route('/login', methods=['POST'])

2def login():

3 user = authenticate(request.form['email'], request.form['password'])

4 if not user:

5 return 'bad credentials', 401

6 session['user_id'] = user.id

7 session['role'] = user.role

8 return redirect('/dashboard')

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.