User Authentication and Sessions

# CHAPTER 11

User Authentication and Sessions #

1. Introduction #

2. Learning Objectives #

• Understand how Flask Sessions work using cryptographically signed cookies.

• Set a SECRET_KEY in app.config.

• Use Werkzeug to securely hash and verify passwords.

• Store data in the session dictionary.

• Protect routes by checking the session state.

3. Beginner-Friendly Explanation #

• Registration (Password Hashing): You give the park your fingerprint. The park scrambles your fingerprint through a complex math formula (Hashing) and saves the scrambled version in their database. They do NOT save your real fingerprint.

• Login (Verification): You return the next day. You scan your fingerprint. The machine runs the math formula again and checks if the new scrambled image matches the one in the database.

• Sessions (The Wristband): The park verifies you, but they don't want you to scan your finger at every single roller coaster. So, they hand you a tamper-proof VIP Wristband (The Session Cookie). For the rest of the day, you just flash the wristband, and the roller coaster attendants let you on instantly.

4. Step 1: Security Configuration #

In app.py:

import os
from flask import Flask, session

app = Flask(__name__)
# Used to digitally sign the session cookie. Keep this secret!
app.config['SECRET_KEY'] = 'my_super_secret_random_string_123'

5. Step 2: Password Hashing #

In app.py:

from werkzeug.security import generate_password_hash, check_password_hash

@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        uname = request.form.get('username')
        pwd = request.form.get('password')
        
        # Scramble the password securely!
        hashed_pwd = generate_password_hash(pwd)
        
        # Save the HASH to the database, not the raw password.
        new_user = User(username=uname, password=hashed_pwd)
        db.session.add(new_user)
        db.session.commit()
        return redirect(url_for('login'))
        
    return render_template('register.html')

6. Step 3: Login and Creating the Session #

In app.py:

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        uname = request.form.get('username')
        pwd = request.form.get('password')
        
        user = User.query.filter_by(username=uname).first()
        
        # Check if user exists AND if the password matches the hash
        if user and check_password_hash(user.password, pwd):
            
            # SUCCESS! Give them the wristband.
            session['user_id'] = user.id
            return redirect(url_for('dashboard'))
            
        return "Invalid credentials."
        
    return render_template('login.html')

7. Step 4: Protecting Routes (Authorization) #

@app.route('/dashboard')
def dashboard():
    # Check if 'user_id' is in the session dictionary
    if 'user_id' not in session:
        return redirect(url_for('login')) # Kick them out!
        
    # If they are logged in, fetch their specific data
    current_user = User.query.get(session['user_id'])
    return f"Welcome to your private dashboard, {current_user.username}!"

8. Step 5: Logging Out #

@app.route('/logout')
def logout():
    # .pop() removes the key safely
    session.pop('user_id', None)
    return redirect(url_for('home'))

9. Backend Workflow: Flask-Login #

10. Best Practices #

• Session Data Size: Flask stores the session dictionary inside a cryptographic cookie sent back to the user's browser. Cookies have a strict size limit of 4KB. Never store large objects (like a whole User database object or large strings) in the session. Only store tiny identifiers like the userid.

• Leaking the Secret Key: Beginners often hardcode app.config['SECRETKEY'] = '12345' and push it to GitHub. If a hacker knows your secret key, they can forge their own session cookie and magically log in as the Administrator! Always hide your secret key in an Environment Variable (Chapter 19).

12. Exercises #

1. 1. Trace the flow: A user registers with the password hello123. Explain exactly what is saved to the SQLite database, and what happens when they attempt to log in with hello123 the next day.

13. Coding Challenges #

• Challenge: In your base.html template, you can access the session object directly! Write an {% if 'userid' in session %} block in your Navbar. If they are logged in, show a link to "Dashboard" and "Logout". If they are NOT logged in, show a link to "Login" and "Register".

18. Next Chapter Recommendation #