Flask Academy · 课时

测试需要身份验证的端点

在测试中登录以访问受保护的路由

测试需要身份验证的端点 是 CoddyKit 上的免费 Flask Academy 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Flask Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Flask Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

The Challenge of Auth Tests

Protected routes refuse anonymous visitors. To test them, your client must first log in, just like a real user would before reaching guarded pages.

Confirm the Guard Works

Start by proving the gate is closed. Request the route logged out and assert you get a redirect or a 401 response.

resp = client.get('/dashboard')
assert resp.status_code == 302

Log In via the Login Route

The realistic way to authenticate is to post credentials to your login endpoint. The client stores the session cookie automatically.

client.post('/login', data={'email': 'a@b.com', 'password': 'pw'})

The Client Keeps Cookies

One handy detail: the test client remembers cookies between calls. After login, later requests stay authenticated with no extra work.

Reach a Protected Route

Now that you are logged in, request the guarded page again. This time assert you get a 200 and see the protected content.

resp = client.get('/dashboard')
assert resp.status_code == 200

A Helper to Log In

Repeating the login post gets noisy. Wrap it in a small helper function so every auth test reads cleanly in one line.

def login(client):
    return client.post('/login', data={'email': 'a@b.com', 'password': 'pw'})

An Authenticated Fixture

Even better, make a fixture that returns an already-logged-in client. Tests that need auth just request it and skip the setup.

@pytest.fixture
def auth_client(client):
    login(client)
    yield client

Test the Logout Flow

Auth is not done until logout works. Hit /logout, then confirm the protected route again rejects the now anonymous client.

client.get('/logout')
assert client.get('/dashboard').status_code == 302

Bypass Login for Speed

For Flask-Login apps you can skip the form and set the session directly. It is faster but tests less of the real login path.

with client.session_transaction() as sess:
    sess['_user_id'] = '1'

Test Token-Protected APIs

For JWT APIs there is no cookie. Send the token in an Authorization header on each request to reach a protected endpoint.

client.get('/api/me', headers={'Authorization': 'Bearer ' + token})

Test Both Sides of the Gate

Strong auth tests check both outcomes: anonymous users are blocked, and authenticated users are allowed. Cover the happy and the sad path.

Quick Check

You need to test a login-only dashboard. What makes it work?

Recap: Authenticated Tests

You log in through the client, lean on its cookie memory, and assert both blocked and allowed paths. Your auth is now fully covered. 🔐

常见问题解答

「测试需要身份验证的端点」课时是免费的吗？

是的 — 「测试需要身份验证的端点」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Flask Academy 课程的其余内容，请升级到 CoddyKit PRO。 Flask Academy 课程共包含 4 节课。

「测试需要身份验证的端点」这节课中我会学到什么？

在测试中登录以访问受保护的路由你通过在浏览器中直接运行的动手代码来练习 Flask Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Flask Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Flask Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「测试需要身份验证的端点」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Flask Academy 课中编写并运行代码吗？

能。每节 Flask Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Flask Academy