I am trying to create a basic login function using Flask, Werkzeug and SQLite. The users are able to register and a hash of their password is stored in a SQLite database, though when I try to login using the correct password the check_password_hash returns false.
Currently I am comparing the password provided by the user to the relevant hash stored in the SQLite database, which was created using generate_password_hash when user registered. I have read the Werkzeug documentation, but couldn't find any solutions.
Perhaps this is something related to how generate_password_hash never outputs the same hash twice? Although I thought that check_password_hash was able to work around that?
Here is the code:
@app.route("/register", methods=["GET", "POST"])
def register():
"""Register user"""
if request.method == "GET":
return render_template("register.html")
if request.method == "POST":
with sqlite3.connect("finance.db") as conn:
cur = conn.cursor()
username = request.form.get("username")
password = request.form.get("password")
confirm_password = request.form.get("confirm-password")
hash_value = generate_password_hash(password)
cur.execute("SELECT * FROM users WHERE username=?", (username,))
valid_username = cur.fetchone()
# Check input and format: Username already taken? Username entered? Password entered? passwords match?
if valid_username:
return ("Username not available")
if not username:
return("Please enter a username")
elif not password:
return("Please enter a password")
elif not confirm_password:
return("Please confirm your password")
elif password != confirm_password:
return ("Passwords do not match")
else:
cur.execute("INSERT INTO users (username,hash) VALUES (?,?)", (username,hash_value))
return redirect("/")
@app.route("/login", methods=["GET", "POST"])
def login():
"""Log user in"""
# Forget any user_id
session.clear()
# User reached route via POST (as by submitting a form via POST)
if request.method == "POST":
# Ensure username was submitted
if not request.form.get("username"):
return apology("must provide username", 403)
# Ensure password was submitted
elif not request.form.get("password"):
return apology("must provide password", 403)
# User login
# Query database for username and hash
with sqlite3.connect("finance.db") as conn:
cur = conn.cursor()
username_field = request.form.get("username")
cur.execute("SELECT username FROM users WHERE username = ?", (username_field,))
username = cur.fetchall()
cur.execute("SELECT hash FROM users WHERE username = ?", (username_field,))
pwhash = cur.fetchone()
# Ensure username exists and password is correct
if len(username) != 1 or not check_password_hash(pwhash, request.form.get("password")):
print(check_password_hash(pwhash, request.form.get("password")))
return apology("invalid username and/or password", 403)
return redirect("/")
# User reached route via GET (as by clicking a link or via redirect)
else:
return render_template("login.html")
Thanks in advance for any help.
Aha! Solved it. Syntax error, pwhash` is a tuple because that is what fetchone() returns, so it need to be check_password_hash(pwhash[0], request.form.get("password")) Thank you so much for the support. It hadn't occurred to me to test the check_password_hash function in isolation, doing that made me realise that I am working with a tuple. Cheers @JanL. Have a nice day.