Password hashing with bcrypt in FastAPI - Mini Project: Build & Apply

Password hashing with bcrypt in FastAPI

📖 Scenario: You are building a simple FastAPI app that needs to securely store user passwords. Instead of saving plain text passwords, you will hash them using bcrypt.

🎯 Goal: Create a FastAPI app that hashes a given password using bcrypt and stores the hashed password in a dictionary.

📋 What You'll Learn

Use the bcrypt library to hash passwords

Create a FastAPI app with a POST endpoint to accept passwords

Store hashed passwords in a dictionary with usernames as keys

Do not store plain text passwords

💡 Why This Matters

🌍 Real World

Web applications must never store plain text passwords. Hashing passwords with bcrypt is a common and secure practice to protect user data.

💼 Career

Understanding password hashing and secure user authentication is essential for backend developers and anyone working on web security.

1

Set up FastAPI app and initial data storage

Import FastAPI from fastapi and create an app instance called app. Then create an empty dictionary called users_db to store usernames and hashed passwords.

FastAPI

from fastapi import FastAPI

# Your code here

Hint

Use app = FastAPI() to create the app and users_db = {} for storage.

2

Add bcrypt import and salt rounds configuration

Import bcrypt and create a variable called SALT_ROUNDS set to 12 to configure the hashing complexity.

FastAPI

from fastapi import FastAPI
import bcrypt

app = FastAPI()
users_db = {}

# Your code here

Hint

Use import bcrypt and set SALT_ROUNDS = 12 for good security.

3

Create POST endpoint to hash and store password

Define a POST endpoint /register that accepts JSON with username and password. Hash the password using bcrypt.hashpw(password.encode(), bcrypt.gensalt(SALT_ROUNDS)) and store the hashed password as a UTF-8 string in users_db under the username key.

FastAPI

from fastapi import FastAPI
import bcrypt
from fastapi import Request

app = FastAPI()
users_db = {}

SALT_ROUNDS = 12

# Your code here

Hint

Use await request.json() to get data and bcrypt.hashpw to hash the password.

4

Add a GET endpoint to verify stored hashed password

Create a GET endpoint /users/{username} that returns the stored hashed password string for the given username from users_db. If the username is not found, return a JSON message {'error': 'User not found'}.

FastAPI

from fastapi import FastAPI
import bcrypt
from fastapi import Request
from fastapi import HTTPException

app = FastAPI()
users_db = {}

SALT_ROUNDS = 12

@app.post('/register')
async def register(request: Request):
    data = await request.json()
    username = data['username']
    password = data['password']
    hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(SALT_ROUNDS))
    users_db[username] = hashed.decode('utf-8')
    return {'message': 'User registered successfully'}

# Your code here

Hint

Use a path parameter username and check if it exists in users_db.

Practice

1. What is the main purpose of using bcrypt for password hashing in FastAPI?

easy

A. To speed up the login process by caching passwords

B. To encrypt passwords so they can be decrypted later

C. To securely store passwords by converting them into a hashed format

D. To generate random passwords for users automatically

Solution

1. Step 1: Understand password hashing purpose

   Password hashing converts passwords into a secure format that cannot be reversed, protecting user data.

2. Step 2: Identify bcrypt role in FastAPI

   bcrypt is used to hash passwords securely, not to encrypt or cache them.

3. Final Answer:

   To securely store passwords by converting them into a hashed format -> Option C

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hashing hides passwords, not encrypts or caches them [OK]

Common Mistakes:

• Confusing hashing with encryption
• Thinking bcrypt speeds up login by caching
• Believing bcrypt generates passwords automatically

2. Which of the following is the correct way to import and create a bcrypt password context using passlib in FastAPI?

easy

A. from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

B. import bcrypt
pwd_context = bcrypt.PasswordContext()

C. from fastapi.security import bcrypt
pwd_context = bcrypt.Context()

D. import passlib
pwd_context = passlib.bcrypt()

Solution

1. Step 1: Recall correct import for bcrypt context

   Passlib's CryptContext is imported from passlib.context and configured with schemes=["bcrypt"].

2. Step 2: Check syntax correctness

   from passlib.context import CryptContext pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") correctly imports and creates pwd_context with bcrypt scheme and deprecated="auto".

3. Final Answer:

   from passlib.context import CryptContext pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") -> Option A

4. Quick Check:

   Correct import and setup = from passlib.context import CryptContext pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") [OK]

Hint: Use CryptContext from passlib.context with schemes=['bcrypt'] [OK]

Common Mistakes:

• Importing bcrypt directly instead of CryptContext
• Using wrong module names like fastapi.security
• Calling non-existent constructors

3. Given the following code snippet, what will be the output of print(pwd_context.verify('secret123', hashed_password)) if hashed_password is generated by hashing 'secret123'?

from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
hashed_password = pwd_context.hash('secret123')
print(pwd_context.verify('secret123', hashed_password))

medium

A. Raises a TypeError

B. True

C. False

D. Prints the hashed password string

Solution

1. Step 1: Understand pwd_context.hash and verify

   pwd_context.hash creates a hashed password from the plain text. verify checks if the plain text matches the hash.

2. Step 2: Analyze the verify call

   Since 'secret123' was hashed and then verified against the same string, verify returns True.

3. Final Answer:

   True -> Option B

4. Quick Check:

   Verify correct password = True [OK]

Hint: Verify returns True if password matches hash [OK]

Common Mistakes:

• Expecting verify to return the hash
• Confusing verify output with hash output
• Thinking verify raises errors on match

4. Identify the error in this FastAPI password hashing code snippet:

from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"])

password = "mypassword"
hashed = pwd_context.hash(password)

if pwd_context.verify(password, hashed):
    print("Password verified")
else:
    print("Verification failed")

medium

A. Using verify method incorrectly with arguments reversed

B. No error; code works correctly

C. Not importing bcrypt module explicitly

D. Missing deprecated="auto" in CryptContext initialization

Solution

1. Step 1: Check CryptContext initialization

   Best practice is to include deprecated="auto" to handle scheme deprecation warnings.

2. Step 2: Verify method usage and imports

   verify is used correctly with (plain, hashed). bcrypt import is not needed explicitly with passlib.

3. Final Answer:

   Missing deprecated="auto" in CryptContext initialization -> Option D

4. Quick Check:

   Include deprecated="auto" to avoid warnings [OK]

Hint: Always add deprecated="auto" in CryptContext [OK]

Common Mistakes:

• Omitting deprecated="auto" causes warnings
• Reversing arguments in verify method
• Importing bcrypt separately when unnecessary

5. You want to create a FastAPI endpoint that accepts a user's plain password, hashes it with bcrypt, and stores it securely. Which of the following code snippets correctly implements this functionality considering best practices?

hard

A. from fastapi import FastAPI
from passlib.context import CryptContext

app = FastAPI()
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

@app.post("/register")
async def register(password: str):
hashed_password = pwd_context.hash(password)
# Store hashed_password securely
return {"msg": "User registered"}

B. from fastapi import FastAPI
import bcrypt

app = FastAPI()

@app.post("/register")
def register(password: str):
hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())
return {"hashed": hashed_password}

C. from fastapi import FastAPI
from passlib.context import CryptContext

app = FastAPI()
pwd_context = CryptContext(schemes=["bcrypt"])

@app.post("/register")
async def register(password: str):
hashed_password = pwd_context.hash(password.encode())
return {"msg": "Password hashed"}

D. from fastapi import FastAPI
from passlib.context import CryptContext

app = FastAPI()
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

@app.post("/register")
async def register(password: bytes):
hashed_password = pwd_context.hash(password)
return {"msg": "User registered"}

Solution

1. Step 1: Check correct use of passlib CryptContext and hashing

   from fastapi import FastAPI from passlib.context import CryptContext app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") @app.post("/register") async def register(password: str): hashed_password = pwd_context.hash(password) # Store hashed_password securely return {"msg": "User registered"} correctly imports CryptContext with deprecated="auto" and hashes the plain string password.

2. Step 2: Validate FastAPI endpoint and parameter types

   from fastapi import FastAPI from passlib.context import CryptContext app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") @app.post("/register") async def register(password: str): hashed_password = pwd_context.hash(password) # Store hashed_password securely return {"msg": "User registered"} uses async def with password as str, which is standard for FastAPI input. It hashes and comments storing securely.

3. Step 3: Compare other options for errors

   from fastapi import FastAPI import bcrypt app = FastAPI() @app.post("/register") def register(password: str): hashed_password = bcrypt.hashpw(password, bcrypt.gensalt()) return {"hashed": hashed_password} uses bcrypt module incorrectly with str instead of bytes; from fastapi import FastAPI from passlib.context import CryptContext app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"]) @app.post("/register") async def register(password: str): hashed_password = pwd_context.hash(password.encode()) return {"msg": "Password hashed"} hashes password.encode() but misses deprecated="auto"; from fastapi import FastAPI from passlib.context import CryptContext app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") @app.post("/register") async def register(password: bytes): hashed_password = pwd_context.hash(password) return {"msg": "User registered"} expects bytes input which is unusual for FastAPI JSON input.

4. Final Answer:

   from fastapi import FastAPI from passlib.context import CryptContext app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") @app.post("/register") async def register(password: str): hashed_password = pwd_context.hash(password) # Store hashed_password securely return {"msg": "User registered"} -> Option A

5. Quick Check:

   Use passlib CryptContext with str input and deprecated="auto" [OK]

Hint: Use passlib CryptContext with str password and deprecated="auto" [OK]

Common Mistakes:

• Using bcrypt module directly with wrong input types
• Omitting deprecated="auto" in CryptContext
• Accepting password as bytes instead of str in FastAPI