User model with password in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask User model password check?

Given this User model code snippet, what will user.check_password('secret') return?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self, username, password):
        self.username = username
        self.password_hash = generate_password_hash(password)

    def check_password(self, password):
        return check_password_hash(self.password_hash, password)

user = User('alice', 'secret')
result = user.check_password('secret')

A None

B True

C False

D Raises TypeError

💡 Hint

Think about what check_password_hash returns when the password matches.

The check_password method returns True if the given password matches the stored hash. Since 'secret' is the correct password, the result is True.

📝 Syntax

intermediate

Which option correctly defines a password setter in a Flask User model?

You want to set a password that stores a hashed version in password_hash. Which code snippet correctly implements this?

Flask

from werkzeug.security import generate_password_hash

class User:
    def __init__(self):
        self.password_hash = ''

    # password setter here

A

    def password(self, password):
        self.password_hash = generate_password_hash(password)

B

    def set_password(self, password):
        self.password_hash = generate_password_hash(password)

C

    @property
    def password(self):
        return self.password

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

D

    @property
    def password(self):
        return self.password_hash

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

💡 Hint

Use Python property decorators to create a setter that hashes the password.

Option D uses @property and @password.setter correctly to hash the password when set. Option D is a method but not a setter property. Option D returns self.password which causes recursion. Option D is just a method without decorator.

🔧 Debug

advanced

Why does this Flask User model password check always return False?

Examine this code and find why user.check_password('secret') returns False even though the password is correct.

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self, username, password):
        self.username = username
        self.password = password

    def check_password(self, password):
        return check_password_hash(self.password, password)

user = User('bob', 'secret')
result = user.check_password('secret')

A The password is stored unhashed in self.password, so check_password_hash fails.

B The check_password method has wrong argument order in check_password_hash.

C The password attribute is missing a setter to hash the password.

D The username attribute conflicts with password hashing.

💡 Hint

Check what is stored in self.password and what check_password_hash expects.

The password is stored as plain text in self.password. The check_password_hash function expects a hashed password as the first argument. Since it receives plain text, it returns False.

❓ state_output

advanced

What is the value of user.password_hash after setting password?

Given this User model, what will user.password_hash contain after user.password = 'mypassword'?

Flask

from werkzeug.security import generate_password_hash

class User:
    def __init__(self):
        self.password_hash = ''

    @property
    def password(self):
        raise AttributeError('Password is write-only')

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

user = User()
user.password = 'mypassword'
result = user.password_hash

A A string starting with 'pbkdf2:sha256:' representing the hashed password

B The plain text string 'mypassword'

C Raises AttributeError

D An empty string ''

💡 Hint

The setter hashes the password before storing it.

The setter uses generate_password_hash to store a hashed version of the password. This hash string usually starts with 'pbkdf2:sha256:'.

🧠 Conceptual

expert

Which statement best explains why storing plain passwords in a Flask User model is insecure?

Why should you never store plain text passwords directly in a User model in Flask?

A Flask automatically hashes passwords, so manual hashing is redundant.

B Storing plain passwords uses more database space than hashed passwords.

C Plain passwords can be stolen if the database is compromised, so hashing protects user data.

D Plain passwords cause syntax errors in Flask models.

💡 Hint

Think about what happens if someone accesses your database without permission.

Storing plain text passwords is risky because if attackers get database access, they see all passwords. Hashing passwords protects users by storing only irreversible hashes.

Practice

1. What is the main purpose of the set_password method in a Flask user model?

easy

A. To delete the user's password from the database

B. To hash and store the user's password securely

C. To check if the password entered matches the stored password

D. To display the user's password in plain text

Solution

1. Step 1: Understand the role of set_password

   This method is used to convert a plain password into a secure hashed version before saving it.

2. Step 2: Differentiate from check_password

   check_password is for verifying passwords, not setting them.

3. Final Answer:

   To hash and store the user's password securely -> Option B

4. Quick Check:

   set_password hashes password [OK]

Hint: Remember: set_password hashes, check_password verifies [OK]

Common Mistakes:

• Confusing set_password with check_password
• Thinking set_password shows the password
• Assuming set_password deletes passwords

2. Which of the following is the correct way to define a password hashing method in a Flask user model using Werkzeug?

easy

A. def set_password(self, password): return check_password_hash(self.password_hash, password)

B. def set_password(self, password): self.password = password

C. def set_password(self, password): self.password_hash = password

D. def set_password(self, password): self.password_hash = generate_password_hash(password)

Solution

1. Step 1: Identify correct hashing usage

   The method must use generate_password_hash to hash the password before storing.

2. Step 2: Check assignment to password_hash

   The hashed password should be saved in self.password_hash, not plain password.

3. Final Answer:

   def set_password(self, password): self.password_hash = generate_password_hash(password) -> Option D

4. Quick Check:

   Use generate_password_hash to store hashed password [OK]

Hint: Use generate_password_hash to hash passwords [OK]

Common Mistakes:

• Storing plain password instead of hashed
• Using check_password_hash inside set_password
• Assigning password to wrong attribute

3. Given this Flask user model snippet, what will user.check_password('secret') return if the password was set with user.set_password('secret')?

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self):
        self.password_hash = ''
    def set_password(self, password):
        self.password_hash = generate_password_hash(password)
    def check_password(self, password):
        return check_password_hash(self.password_hash, password)

user = User()
user.set_password('secret')

medium

A. None

B. False

C. True

D. Raises an error

Solution

1. Step 1: Understand password setting

   The password 'secret' is hashed and stored in password_hash.

2. Step 2: Check password verification

   check_password compares the hash with 'secret' and returns True if they match.

3. Final Answer:

   True -> Option C

4. Quick Check:

   Matching password returns True [OK]

Hint: check_password returns True if password matches hash [OK]

Common Mistakes:

• Expecting False for correct password
• Thinking check_password returns the hash
• Assuming error if password matches

4. Identify the error in this Flask user model code snippet:

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self):
        self.password_hash = None
    def set_password(self, password):
        self.password_hash = generate_password_hash(password)
    def check_password(self, password):
        return check_password_hash(password, self.password_hash)

medium

A. The order of arguments in check_password_hash is reversed

B. password_hash should be initialized as an empty string, not None

C. set_password should return the hashed password

D. The class is missing a username attribute

Solution

1. Step 1: Review check_password_hash usage

   The correct order is check_password_hash(stored_hash, password).

2. Step 2: Identify argument mistake

   The code passes password first and self.password_hash second, which is wrong.

3. Final Answer:

   The order of arguments in check_password_hash is reversed -> Option A

4. Quick Check:

   check_password_hash needs (hash, password) order [OK]

Hint: check_password_hash(hash, password) order matters [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Initializing password_hash as None causes no error but is not best
• Expecting set_password to return a value
• Confusing missing attributes with password errors

5. You want to add a method change_password to your Flask user model that updates the password only if the old password matches. Which implementation correctly applies this logic?

hard

A. def change_password(self, old_password, new_password):
if self.check_password(old_password):
self.set_password(new_password)
return True
return False

B. def change_password(self, old_password, new_password):
self.set_password(new_password)
return True

C. def change_password(self, old_password, new_password):
if old_password == new_password:
self.set_password(new_password)
return True
return False

D. def change_password(self, old_password, new_password):
if not self.check_password(new_password):
self.set_password(old_password)
return True
return False

Solution

1. Step 1: Verify old password before changing

   The method must check if the old password matches using check_password.

2. Step 2: Update password only if old password is correct

   If the check passes, call set_password with the new password and return True; else return False.

3. Final Answer:

   def change_password(self, old_password, new_password): if self.check_password(old_password): self.set_password(new_password) return True return False -> Option A

4. Quick Check:

   Change password only if old password matches [OK]

Hint: Always verify old password before setting new one [OK]

Common Mistakes:

• Changing password without verifying old password
• Comparing old and new passwords incorrectly
• Swapping old and new passwords in checks