User model with password in Flask - Performance & Optimization

Performance: User model with password

MEDIUM IMPACT

This affects page load speed and interaction responsiveness when user authentication is involved, especially during login and registration.

Storing and verifying user passwords securely and efficiently

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    password_hash = db.Column(db.String(128), nullable=False)

    def set_password(self, password):
        self.password_hash = generate_password_hash(password)

    def check_password(self, password):
        return check_password_hash(self.password_hash, password)

Hashes passwords securely, reducing risk and allowing fast, optimized password verification without exposing raw passwords.

📈 Performance GainImproves interaction responsiveness by enabling fast, secure password checks and reducing server load from security incidents

Storing and verifying user passwords securely and efficiently

Flask

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    password = db.Column(db.String(80), nullable=False)  # storing plain text password

    def check_password(self, password):
        return self.password == password

Storing passwords in plain text causes security risks and forces server to do string comparisons that can be exploited; also, it can increase server load if password checks are inefficient.

📉 Performance CostBlocks interaction responsiveness due to potential security breaches and inefficient password checks

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Plain text password storage and check	None (server-side)	None	None	[X] Bad
Hashed password storage with werkzeug	None (server-side)	None	None	[OK] Good

Rendering Pipeline

Password hashing and verification happen on the server side and do not directly affect browser rendering, but inefficient handling can delay server responses, impacting user interaction speed.

→Server Processing

→Network Response

→User Interaction

⚠️ BottleneckServer Processing during password hash computation

Core Web Vital Affected

INP

This affects page load speed and interaction responsiveness when user authentication is involved, especially during login and registration.

Optimization Tips

1Never store passwords in plain text; always hash them securely.

2Use efficient hashing libraries to minimize server processing delays.

3Fast server response on authentication improves user interaction speed.

Performance Quiz - 3 Questions

Why is storing plain text passwords a performance and security problem?

A It causes more DOM reflows during rendering

B It increases server load and risks security breaches slowing interaction

C It makes the page load slower due to large password size

D It improves password check speed

DevTools: Network

How to check: Open DevTools, go to Network tab, perform login, and check server response time for authentication requests.

What to look for: Look for fast response times and no repeated failed requests indicating efficient password verification.