Frameworks foundations: check what you know

Already know some Frameworks? Answer these 11 questions, about 6 minutes. Each topic you get fully right is marked Known on the Frameworks roadmap, so you can skip it. Each one you miss is listed for you to study.

Don’t guess. Pick “I don’t know yet” when you’re not sure: a lucky guess would mark a topic Known that you still need to learn.

The 7 topics it checks

1. HTTP methods and status codes
2. WSGI vs ASGI
3. The request lifecycle
4. REST design
5. Sessions, JWT and OAuth2
6. CORS and CSRF
7. Top OWASP risks: injection, XSS, broken authentication

1. Question 1 of 11 · Multiple choiceA client sends POST /notes and the note is saved. What should the API answer?

   200 OK, with the note204 No Content201 Created, with a Location header pointing at the new note302 Found, to the listI don’t know yet
2. Question 2 of 11 · Multiple choiceA request times out and the client can’t tell if it arrived. Which method is safe to just send again?

   PUT /notes/7 with the full notePOST /ordersPOST /paymentsPATCH /counter with {"add": 1}I don’t know yet
3. Question 3 of 11 · Multiple choiceA Flask app on 4 sync workers holds 200 open chat connections that wait for new messages. What happens?

   All 200 are served at onceThe connections are closed after one secondFlask turns them into async tasksEach worker holds one waiting connection, so only 4 are served and the rest queueI don’t know yet
4. Question 4 of 11 · Predict the outputTwo middlewares wrap a view: A outside, B inside. Each prints on the way in and on the way out. What is printed?

   # A: print("A in");  response = next(request);  print("A out")
   # B: print("B in");  response = next(request);  print("B out")
   # view: print("view")
   

   A in, B in, view, A out, B outA in, B in, view, B out, A outB in, A in, view, A out, B outview, A in, B in, B out, A outI don’t know yet
5. Question 5 of 11 · Multiple choiceNotes are added while a user scrolls with ?offset=20&limit=20. Some notes show up twice. What fixes it?

   A bigger limitSorting by titleA cursor: ask for notes after the last id seenCaching the first pageI don’t know yet
6. Question 6 of 11 · Multiple choiceUsers are logged out at random behind a load balancer with two servers. What is the likely cause?

   Sessions are kept in each server’s memoryThe cookie is HttpOnlyThe JWT is signed with HS256The password hash is too slowI don’t know yet
7. Question 7 of 11 · Multiple choiceWhat is true of a JWT?

   It is encrypted, so the client can’t read itIt can be cancelled at once from the serverThe server must look it up in a database on each requestIt is signed, so the client can read it but not change itI don’t know yet
8. Question 8 of 11 · Multiple choiceYour API sets Access-Control-Allow-Origin: * and logged-in calls from your front end now fail. Why?

   The API needs HTTPSBrowsers refuse * when cookies are sent; name the origin and allow credentials* only works for POSTThe front end must send Origin: *I don’t know yet
9. Question 9 of 11 · Multiple choiceDoes a strict CORS allow list stop another site’s hidden form from posting to your cookie-based API?

   Yes, the browser blocks the postYes, but only for JSONNo: CORS only stops reading the answer. Use SameSite cookies and CSRF tokensNo, nothing can stop itI don’t know yet
10. Question 10 of 11 · Spot the bugWhat is the problem here?

    rows = db.execute(f"SELECT * FROM notes WHERE owner = {user_id} AND title = '{title}'")
    

    The title is pasted into the SQL, so a quote in it can change the queryIt should use SELECT titleuser_id should be a stringNothingI don’t know yet
11. Question 11 of 11 · Multiple choiceBen changes /notes/41 to /notes/42 and can edit Ana’s note. What was missing?

    HTTPSA slower password hashA CSRF tokenA check that the note belongs to BenI don’t know yet

See my results

Answered 0 of 11.