A login system needs to recognize a password without storing it as plain text. bcrypt creates a computationally expensive password hash, making brute-force guessing harder even as CPU and GPU power increases. If someone gains access to the user database, stored hashes offer protection that plain-text passwords would not. section 8.2.1
In a Flask application, Flask_bcrypt supplies password-hashing functionality alongside the login and user-storage components. The application imports generate_password_hash and check_password_hash; its User model stores a hashed_password field rather than a plain-text password. A forgotten password must be reset, not retrieved from storage. section 8.2.1
class User(UserMixin, db.Model): #1
__tablename__ = "user" #2
user_uid = db.Column(db.String, primary_key=True, default=get_uuid) #3
first_name = db.Column(db.String, nullable=False) #4
last_name = db.Column(db.String, nullable=False) #4
email = db.Column(db.String, nullable=False, #4
unique=True, index=True) #4
hashed_password = db.Column("password", #4
db.String, nullable=False) #4
active = db.Column(db.Boolean, nullable=False, default=False) #4
created = db.Column(db.DateTime, nullable=False, #5
default=datetime.utcnow) #5
updated = db.Column(db.DateTime, nullable=False, #5
default=datetime.utcnow, onupdate=datetime.utcnow) #5
def get_id(self):
return self.user_uid
@property
def password(self):
raise AttributeError("user password can’t be read")
@password.setter
def password(self, password):
self.hashed_password = generate_password_hash(password)
def verify_password(self, password):
return check_password_hash(self.hashed_password, password)
def __repr__(self):
return f"""
user_uid: {self.user_uid}
name: {self.first_name} {self.last_name}
email: {self.email}
active: {'True' if self.active else 'False'}
"""
The User model’s hashed_password field shows where the password hash belongs in persistent user data. section 8.2.1
