The Project | About Us | Contribute | Donations | License
HOME My courses Completed
◄ Previous
◄

Password Hashing

Next ►
►

In this section, we will cover the importance of password hashing, how to implement it in a Flask application, and best practices to ensure the security of user passwords.

Why Password Hashing?

Password hashing is a critical security measure for any application that handles user authentication. Instead of storing plain text passwords, which can be easily compromised, we store hashed versions of passwords. Hashing transforms the password into a fixed-length string of characters, which is not reversible. This means even if the hashed passwords are exposed, the original passwords remain secure.

Key Concepts:

  • Hash Function: A function that converts an input (or 'message') into a fixed-length string of bytes.
  • Salt: Random data added to the password before hashing to ensure that identical passwords have different hashes.
  • Pepper: A secret value added to the password before hashing, stored separately from the database.

Implementing Password Hashing in Flask

We will use the werkzeug.security module, which provides convenient functions for hashing and verifying passwords.

Step-by-Step Guide

  1. Install Werkzeug

Ensure you have Werkzeug installed. It is included with Flask, but you can install it separately if needed:

pip install werkzeug

  1. Hashing a Password

Use the generate_password_hash function to hash a password:

from werkzeug.security import generate_password_hash

password = "mysecretpassword"
hashed_password = generate_password_hash(password)
print(hashed_password)

  1. Verifying a Password

Use the check_password_hash function to verify a password against its hash:

from werkzeug.security import check_password_hash

# Assume hashed_password is retrieved from the database
hashed_password = "$pbkdf2-sha256$29000$8bB1J1...$..."

password = "mysecretpassword"
is_correct = check_password_hash(hashed_password, password)
print(is_correct)  # True if the password matches

  1. Integrating with User Registration and Login

User Registration

When a user registers, hash their password before storing it in the database:

from flask import Flask, request, redirect, url_for, render_template
from werkzeug.security import generate_password_hash
from yourapp import db, User  # Assuming you have a User model and db setup

app = Flask(__name__)

@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        hashed_password = generate_password_hash(password)
        
        new_user = User(username=username, password=hashed_password)
        db.session.add(new_user)
        db.session.commit()
        
        return redirect(url_for('login'))
    return render_template('register.html')

User Login

When a user logs in, verify their password against the stored hash:

from flask import Flask, request, redirect, url_for, render_template, flash
from werkzeug.security import check_password_hash
from yourapp import db, User  # Assuming you have a User model and db setup

app = Flask(__name__)

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        
        user = User.query.filter_by(username=username).first()
        if user and check_password_hash(user.password, password):
            # User is authenticated
            return redirect(url_for('dashboard'))
        else:
            flash('Invalid username or password')
    return render_template('login.html')

Practical Exercise

Exercise: Implement Password Hashing

  1. Objective: Implement password hashing in a simple Flask application with user registration and login functionality.
  2. Steps:
    • Create a Flask application with routes for registration and login.
    • Use generate_password_hash to hash passwords during registration.
    • Use check_password_hash to verify passwords during login.
  3. Solution:
    • Follow the code examples provided above to implement the registration and login routes.

Common Mistakes and Tips

  • Mistake: Storing plain text passwords.
    • Tip: Always hash passwords before storing them in the database.
  • Mistake: Using weak hash functions.
    • Tip: Use strong, industry-standard hash functions like PBKDF2, bcrypt, or Argon2.
  • Mistake: Not using a salt.
    • Tip: Always use a salt to ensure that identical passwords have different hashes.

Conclusion

In this section, we learned about the importance of password hashing and how to implement it in a Flask application using Werkzeug. We covered the basic concepts, provided practical examples, and highlighted common mistakes to avoid. Password hashing is a fundamental security measure that helps protect user data and maintain the integrity of your application.

◄ Previous
◄
Next ►
►
The Project | About Us | Contribute | Donations | License
© Copyright 2024. All rights reserved