Security

For user authentication security, we will use Flask's httpauth extension, written by Miguel Grinberg, as well as the password functions in Werkzeug. The httpauth extension should have been installed as part of the requirements.txt installation at the beginning of this chapter. The new file illustrating the security feature is named chapter9_9.py; we will start with a few more module imports:

...
from werkzeug.security import generate_password_hash, check_password_hash
from flask.ext.httpauth import HTTPBasicAuth
...

We will create an HTTPBasicAuth object as well as the user database object. Note that, during the user creation process, we will pass the password value; however, we are only storing password_hash instead of the password itself. This ensures that we are not storing a clear text password for the user: 

auth = HTTPBasicAuth()

class User(db.Model):
    __tablename__ = 'users'
id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(64), index=True)...