Password storage best practices in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use salted hashes for passwords?

In Flask applications, why is it important to store passwords as salted hashes instead of plain hashes?

A Salting passwords automatically encrypts the password with a secret key.

B Salting passwords makes the hash shorter and easier to store in the database.

C Salting passwords allows the server to decrypt the password when needed.

D Salting passwords prevents attackers from using precomputed tables to reverse hashes easily.

💡 Hint

Think about how attackers try to guess passwords using pre-made lists.

Salting adds unique random data to each password before hashing. This stops attackers from using precomputed hash tables (rainbow tables) to reverse hashes quickly.

❓ component_behavior

intermediate

Flask password hashing with werkzeug.security

What will be the output of this Flask code snippet when checking a password?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('mypassword')
result = check_password_hash(hashed, 'wrongpassword')
print(result)

A Raises TypeError

B True

C False

D None

💡 Hint

Check what happens when the password does not match the hash.

The function check_password_hash returns False if the password does not match the stored hash.

📝 Syntax

advanced

Identify the correct way to hash a password in Flask

Which code snippet correctly hashes a password using werkzeug.security in Flask?

A hashed = generate_password_hash(password, salt='randomsalt')

B hashed = generate_password_hash(password, method='pbkdf2:sha256')

C hashed = generate_password_hash(password, method='sha256')

D hashed = generate_password_hash(password, rounds=1000)

💡 Hint

Look for the recommended secure hashing method in werkzeug.

The default and recommended method is pbkdf2:sha256. Options like salt or rounds are not valid parameters.

🔧 Debug

advanced

Why does this password check always fail?

Consider this Flask code snippet:

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('secret')
if check_password_hash('secret', 'secret'):
    print('Access granted')
else:
    print('Access denied')

Why does it always print 'Access denied'?

A The first argument to <code>check_password_hash</code> should be the hashed password, not the plain password.

B The password string 'secret' is too short to be hashed correctly.

C The <code>generate_password_hash</code> function does not return a valid hash.

D The <code>check_password_hash</code> function requires a salt argument.

💡 Hint

Check the order and meaning of arguments in check_password_hash.

The first argument to check_password_hash must be the hashed password string. Passing the plain password causes the check to fail.

❓ state_output

expert

Password hash uniqueness with same input

Given this Flask code:

from werkzeug.security import generate_password_hash

hash1 = generate_password_hash('mypassword')
hash2 = generate_password_hash('mypassword')
print(hash1 == hash2)

What will be printed and why?

A False, because each hash includes a unique salt making hashes different even for the same password.

B None, because the hashes are not comparable strings.

C Raises TypeError because generate_password_hash cannot be called twice with the same input.

D True, because hashing the same password always produces the same hash.

💡 Hint

Think about how salting affects the output of hashing.

Each call to generate_password_hash creates a new random salt, so even the same password produces different hashes. This improves security by preventing hash comparison attacks.

Practice

1. Why should you never store plain text passwords directly in your Flask application's database?

easy

A. Because plain text passwords can be easily stolen if the database is compromised.

B. Because plain text passwords take up more space than hashed passwords.

C. Because Flask does not support storing plain text passwords.

D. Because hashed passwords are faster to compare than plain text passwords.

Solution

1. Step 1: Understand password security risks

   Storing plain text passwords means if someone hacks the database, they get all user passwords directly.

2. Step 2: Importance of hashing

   Hashing transforms passwords into unreadable strings, protecting user data even if the database leaks.

3. Final Answer:

   Because plain text passwords can be easily stolen if the database is compromised. -> Option A

4. Quick Check:

   Password safety = Avoid plain text storage [OK]

Hint: Never store passwords as plain text, always hash first [OK]

Common Mistakes:

• Thinking hashing is optional
• Believing plain text is safe if database is secure
• Confusing hashing with encryption

2. Which of the following is the correct way to hash a password using Werkzeug in Flask?

easy

A. hashed = make_password(password)

B. hashed = generate_password_hash(password)

C. hashed = password_hash(password)

D. hashed = hash_password(password)

Solution

1. Step 1: Recall Werkzeug's hashing function

   Werkzeug provides generate_password_hash to hash passwords securely.

2. Step 2: Identify correct function usage

   The correct function call is generate_password_hash(password), other options are invalid or non-existent.

3. Final Answer:

   hashed = generate_password_hash(password) -> Option B

4. Quick Check:

   Use generate_password_hash() to hash passwords [OK]

Hint: Use generate_password_hash() from Werkzeug to hash passwords [OK]

Common Mistakes:

• Using non-existent functions like hash_password
• Confusing hashing with encryption functions
• Trying to hash passwords manually

3. What will the following Flask code output if the password check is correct?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('secret123')
result = check_password_hash(hashed, 'secret123')
print(result)

medium

A. False

B. secret123

C. Error

D. True

Solution

1. Step 1: Understand generate_password_hash output

   This function creates a hashed string from 'secret123'.

2. Step 2: Check password correctness with check_password_hash

   It compares the hashed password with the plain text 'secret123' and returns True if they match.

3. Final Answer:

   True -> Option D

4. Quick Check:

   check_password_hash returns True if passwords match [OK]

Hint: check_password_hash returns True when password matches hash [OK]

Common Mistakes:

• Expecting the original password as output
• Confusing True/False return values
• Assuming check_password_hash modifies the hash

4. Identify the error in this Flask password check code:

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
if check_password_hash('mypassword', hashed):
    print('Access granted')

medium

A. The hashed and plain password arguments are reversed in check_password_hash.

B. generate_password_hash should not be used for hashing passwords.

C. The print statement should be outside the if block.

D. There is no error; the code works correctly.

Solution

1. Step 1: Check argument order in check_password_hash

   The first argument must be the hashed password, second is the plain password.

2. Step 2: Identify the reversed arguments

   The code passes plain password first and hash second, causing a logic error.

3. Final Answer:

   The hashed and plain password arguments are reversed in check_password_hash. -> Option A

4. Quick Check:

   check_password_hash(hash, password) order matters [OK]

Hint: Pass hashed first, plain password second to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Using generate_password_hash incorrectly
• Ignoring function argument order

5. You want to securely store user passwords in your Flask app and verify them on login. Which approach follows best practices?

hard

A. Store plain passwords in the database and compare them directly on login.

B. Encrypt passwords with a reversible method and decrypt them on login to compare.

C. Hash passwords with generate_password_hash before storing, then verify with check_password_hash during login.

D. Store passwords as plain text but log them only during login attempts.

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to prevent exposure if database leaks.

2. Step 2: Verify passwords securely on login

   Use check_password_hash to compare the stored hash with the login password safely.

3. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash during login. -> Option C

4. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Hash before store, verify with check_password_hash on login [OK]

Common Mistakes:

• Storing or logging plain passwords
• Using reversible encryption instead of hashing
• Comparing plain passwords directly