Security

For user authentication security, we will use Flask's extension httpauth, written by Miguel Grinberg, as well as the password functions in Werkzeug. The httpauth extension should have been installed as part of the requirements.txt installation in the beginning of the chapter. The file is named chapter9_9.py; we will start with a few more module imports:

...
from werkzeug.security import generate_password_hash, check_password_hash
from flask.ext.httpauth import HTTPBasicAuth
...

We will create an HTTPBasicAuth object as well as the user database object. Note that during the user creation process, we will pass the password value; however, we are only storing password_hash instead of the password itself:

auth = HTTPBasicAuth()

class User(db.Model):
    __tablename__ = 'users'
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(64), index=True)
    password_hash = db.Column(db.String(128))

    def set_password(self, password):
        self.password_hash...