User model with password in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask User model password check?

Given this User model code snippet, what will user.check_password('secret') return?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self, username, password):
        self.username = username
        self.password_hash = generate_password_hash(password)

    def check_password(self, password):
        return check_password_hash(self.password_hash, password)

user = User('alice', 'secret')
result = user.check_password('secret')

A None

B True

C False

D Raises TypeError

💡 Hint

Think about what check_password_hash returns when the password matches.

The check_password method returns True if the given password matches the stored hash. Since 'secret' is the correct password, the result is True.

📝 Syntax

intermediate

Which option correctly defines a password setter in a Flask User model?

You want to set a password that stores a hashed version in password_hash. Which code snippet correctly implements this?

Flask

from werkzeug.security import generate_password_hash

class User:
    def __init__(self):
        self.password_hash = ''

    # password setter here

A

    def password(self, password):
        self.password_hash = generate_password_hash(password)

B

    def set_password(self, password):
        self.password_hash = generate_password_hash(password)

C

    @property
    def password(self):
        return self.password

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

D

    @property
    def password(self):
        return self.password_hash

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

💡 Hint

Use Python property decorators to create a setter that hashes the password.

Option D uses @property and @password.setter correctly to hash the password when set. Option D is a method but not a setter property. Option D returns self.password which causes recursion. Option D is just a method without decorator.

🔧 Debug

advanced

Why does this Flask User model password check always return False?

Examine this code and find why user.check_password('secret') returns False even though the password is correct.

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self, username, password):
        self.username = username
        self.password = password

    def check_password(self, password):
        return check_password_hash(self.password, password)

user = User('bob', 'secret')
result = user.check_password('secret')

A The password is stored unhashed in self.password, so check_password_hash fails.

B The check_password method has wrong argument order in check_password_hash.

C The password attribute is missing a setter to hash the password.

D The username attribute conflicts with password hashing.

💡 Hint

Check what is stored in self.password and what check_password_hash expects.

The password is stored as plain text in self.password. The check_password_hash function expects a hashed password as the first argument. Since it receives plain text, it returns False.

❓ state_output

advanced

What is the value of user.password_hash after setting password?

Given this User model, what will user.password_hash contain after user.password = 'mypassword'?

Flask

from werkzeug.security import generate_password_hash

class User:
    def __init__(self):
        self.password_hash = ''

    @property
    def password(self):
        raise AttributeError('Password is write-only')

    @password.setter
    def password(self, password):
        self.password_hash = generate_password_hash(password)

user = User()
user.password = 'mypassword'
result = user.password_hash

A A string starting with 'pbkdf2:sha256:' representing the hashed password

B The plain text string 'mypassword'

C Raises AttributeError

D An empty string ''

💡 Hint

The setter hashes the password before storing it.

The setter uses generate_password_hash to store a hashed version of the password. This hash string usually starts with 'pbkdf2:sha256:'.

🧠 Conceptual

expert

Which statement best explains why storing plain passwords in a Flask User model is insecure?

Why should you never store plain text passwords directly in a User model in Flask?

A Flask automatically hashes passwords, so manual hashing is redundant.

B Storing plain passwords uses more database space than hashed passwords.

C Plain passwords can be stolen if the database is compromised, so hashing protects user data.

D Plain passwords cause syntax errors in Flask models.

💡 Hint

Think about what happens if someone accesses your database without permission.

Storing plain text passwords is risky because if attackers get database access, they see all passwords. Hashing passwords protects users by storing only irreversible hashes.