A login system needs to recognize returning users without keeping their passwords in plain text. Flask-Bcrypt supplies password hashing for a Flask application: the application stores a hash, then checks a submitted password against it during login. Its computationally expensive bcrypt hashes help resist brute-force attacks. section 8.2.1
In a blog application, Flask-Bcrypt is one part of the login workflow. A submitted form leads to a user lookup; the User model has a hashed_password field, while Flask-Login manages user identification and SQLAlchemy manages persistence. Keep these responsibilities separate: hashing protects stored passwords, but it does not replace login handling or user storage. section 8.2.1
To wire it into the application:
- Install the application requirements in a Python virtual environment. section 8.2.1
- Create a Bcrypt extension object and initialize it with the Flask app alongside the login manager and database. section 8.2.1
- Use generate_password_hash and check_password_hash where user passwords are stored and checked. section 8.2.1
from contextlib import contextmanager
from flask_bcrypt import (
generate_password_hash,
check_password_hash
)
from . import db
from flask_login import UserMixin
from uuid import uuid4
from datetime import datetime
These imports show the two password operations alongside the User model’s database and Flask-Login dependencies. section 8.2.1
Never store a plain-text password. Hashing also means a forgotten password must be reset rather than recovered. Flask-Bcrypt contributes to a serviceable login and authorization system, not a complete security strategy; tighter requirements may call for two-factor authentication or hosted authentication. section 8.2.1 section 9.8
