Password storage best practices in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use salted hashes for passwords?

In Flask applications, why is it important to store passwords as salted hashes instead of plain hashes?

A Salting passwords automatically encrypts the password with a secret key.

B Salting passwords makes the hash shorter and easier to store in the database.

C Salting passwords allows the server to decrypt the password when needed.

D Salting passwords prevents attackers from using precomputed tables to reverse hashes easily.

💡 Hint

Think about how attackers try to guess passwords using pre-made lists.

Salting adds unique random data to each password before hashing. This stops attackers from using precomputed hash tables (rainbow tables) to reverse hashes quickly.

❓ component_behavior

intermediate

Flask password hashing with werkzeug.security

What will be the output of this Flask code snippet when checking a password?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('mypassword')
result = check_password_hash(hashed, 'wrongpassword')
print(result)

A Raises TypeError

B True

C False

D None

💡 Hint

Check what happens when the password does not match the hash.

The function check_password_hash returns False if the password does not match the stored hash.

📝 Syntax

advanced

Identify the correct way to hash a password in Flask

Which code snippet correctly hashes a password using werkzeug.security in Flask?

A hashed = generate_password_hash(password, salt='randomsalt')

B hashed = generate_password_hash(password, method='pbkdf2:sha256')

C hashed = generate_password_hash(password, method='sha256')

D hashed = generate_password_hash(password, rounds=1000)

💡 Hint

Look for the recommended secure hashing method in werkzeug.

The default and recommended method is pbkdf2:sha256. Options like salt or rounds are not valid parameters.

🔧 Debug

advanced

Why does this password check always fail?

Consider this Flask code snippet:

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('secret')
if check_password_hash('secret', 'secret'):
    print('Access granted')
else:
    print('Access denied')

Why does it always print 'Access denied'?

A The first argument to <code>check_password_hash</code> should be the hashed password, not the plain password.

B The password string 'secret' is too short to be hashed correctly.

C The <code>generate_password_hash</code> function does not return a valid hash.

D The <code>check_password_hash</code> function requires a salt argument.

💡 Hint

Check the order and meaning of arguments in check_password_hash.

The first argument to check_password_hash must be the hashed password string. Passing the plain password causes the check to fail.

❓ state_output

expert

Password hash uniqueness with same input

Given this Flask code:

from werkzeug.security import generate_password_hash

hash1 = generate_password_hash('mypassword')
hash2 = generate_password_hash('mypassword')
print(hash1 == hash2)

What will be printed and why?

A False, because each hash includes a unique salt making hashes different even for the same password.

B None, because the hashes are not comparable strings.

C Raises TypeError because generate_password_hash cannot be called twice with the same input.

D True, because hashing the same password always produces the same hash.

💡 Hint

Think about how salting affects the output of hashing.

Each call to generate_password_hash creates a new random salt, so even the same password produces different hashes. This improves security by preventing hash comparison attacks.