Password hashing with Werkzeug in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the function used for hashing passwords.

Flask

from werkzeug.security import [1]

Drag options to blanks, or click blank then click option'

Agenerate_password_hash

Bcheck_password_hash

Chash_password

Dpassword_hash

Attempts:

3 left

💡 Hint

Common Mistakes

Importing the wrong function like check_password_hash

Using a non-existent function name

The generate_password_hash function is used to create a hashed password securely.

2fill in blank

medium

Complete the code to hash the password string 'mypassword'.

Flask

hashed = generate_password_hash([1])

Drag options to blanks, or click blank then click option'

A'mypassword'.encode('utf-8')

B'mypassword'

Cb'mypassword'

Dmypassword

Attempts:

3 left

💡 Hint

Common Mistakes

Passing bytes instead of string

Passing a variable not defined

The generate_password_hash function accepts a plain string password directly.

3fill in blank

hard

Fix the error in the code to verify a password against its hash.

Flask

check_password_hash([1], 'mypassword')

Drag options to blanks, or click blank then click option'

Ahashed_password

B'hashed_password'

Cpassword_hash

Dhash_password

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the variable name as a string

Using an undefined variable

The first argument must be the hashed password variable, not a string literal.

4fill in blank

hard

Fill both blanks to hash a password with method 'pbkdf2:sha256' and salt length 16.

Flask

hashed = generate_password_hash('secret', method=[1], salt_length=[2])

Drag options to blanks, or click blank then click option'

A'pbkdf2:sha256'

B16

C'sha256'

D8

Attempts:

3 left

💡 Hint

Common Mistakes

Using just 'sha256' as method

Using too small salt length

The method parameter specifies the hashing algorithm, and salt_length sets the salt size.

5fill in blank

hard

Fill all three blanks to check a password and print a message if it matches.

Flask

if check_password_hash([1], [2]):
    print([3])

Drag options to blanks, or click blank then click option'

Ahashed_pw

B'user_input'

C'Password is correct!'

D'Password matches'

Attempts:

3 left

💡 Hint

Common Mistakes

Using string literals instead of variables

Printing unclear messages

Use the hashed password variable, the user input string, and a clear success message.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly