Session-Based Authentication & Password Hashing

1. The Cardinal Rule of Web Security: Never Store Plain-Text Passwords

Let's start with the most critical aspect: password security. When a user trusts you with their password, it's your responsibility to protect it.

Imagine we store passwords directly in our database.

-- This is DANGEROUS and WRONG!
CREATE TABLE users (
    id INT PRIMARY KEY,
    username VARCHAR(80) UNIQUE NOT NULL,
    password VARCHAR(120) NOT NULL -- Storing the actual password!
);

If an attacker gains access to this database—a scenario that happens more often than you'd think—they instantly have the usernames and passwords for all your users. Since many people reuse passwords across different services, this breach could compromise their email, banking, and social media accounts.

To prevent this, we use a technique called password hashing.

What is Hashing?

A hash function is a one-way cryptographic operation. It takes an input (the password) and produces a fixed-size string of characters, called a hash.

• One-way: It's computationally infeasible to reverse the process—you can't get the original password back from its hash. This is like mixing different colors of paint; once mixed, you can't easily separate them back into the original colors.
• Deterministic: The same input will always produce the same output hash.

This means we don't store the user's password. Instead, we store its hash. When a user tries to log in, we hash the password they entered and compare it to the hash stored in our database. If they match, the password is correct.

The following video provides an excellent "tier list" of password storage methods, starting from the worst (plain text) and working up to secure, modern techniques.

2. Making Hashing Robust: Salt and Slow Functions

As you just saw, basic hashing is a huge step up, but it's still vulnerable to certain attacks.

• Dictionary Attacks & Rainbow Tables: Attackers can pre-compute the hashes of common passwords (like "123456", "password", etc.) and store them in a massive lookup table called a rainbow table. By comparing the hashes in your database to their table, they can quickly crack weak passwords.

To defeat this, we use salting. A salt is a unique, random string that we generate for each user and append to their password before hashing it. We then store the salt alongside the hashed password in the database.

Without Salt:
hash("password123") -> a9dd...
(Every user with "password123" has the same hash)

With Salt:
hash("password123" + "salt_for_user_A") -> b4fe...
hash("password123" + "salt_for_user_B") -> c1a0...
(Now, every hash is unique, making rainbow tables useless)

However, modern GPUs can compute billions of hashes per second, making it feasible for an attacker to try common passwords one by one for a specific user (a dictionary attack). To counter this, we use deliberately slow hash functions like Bcrypt, Scrypt, or Argon2. These algorithms are designed to be computationally expensive, slowing down attackers to a crawl and making brute-force attacks impractical.

Let's return to the video to see how these concepts complete the picture of modern password security.

Libraries like werkzeug (which comes with Flask) and passlib handle all of this for you. For example, werkzeug.security.generate_password_hash() automatically uses a strong algorithm (like scrypt or pbkdf2_sha256) and generates a salt.

3. Remembering the User: Session-Based Authentication

Now that we can securely verify a user's password, how do we keep them logged in as they navigate from the /login page to their /profile or /dashboard? HTTP is a "stateless" protocol, meaning each request is independent. The server doesn't inherently know that the request for /profile is from the same user who just logged in.

This is where sessions come in. Session-based authentication creates a stateful connection over the stateless HTTP protocol.

Here's the flow:

1. Login: A user sends their username and password to the server.
2. Verification: The server verifies the credentials (using check_password_hash).
3. Session Creation: Upon success, the server creates a "session" and stores some information on its side, like user_id: 123.
4. Cookie: The server sends a unique Session ID back to the user's browser in a cookie. A cookie is a small piece of data that the browser stores and sends back to the server with every subsequent request.
5. Subsequent Requests: When the user requests a new page, their browser automatically includes the cookie with the Session ID.
6. Authorization: The server receives the Session ID, looks up the corresponding session data, finds user_id: 123, and treats the request as coming from that user.

To understand this process in more detail, let's watch a short, clear explanation.

In Flask, the Flask-Login extension manages this entire session lifecycle for us. When you call its login_user() function, it creates an entry in Flask's session object and handles the cookie management. On each new request, it uses a user_loader function that you provide to retrieve the user from the database using the ID stored in the session.

Conclusion

In this lesson, we covered the essential security and state-management principles behind user authentication. You are now equipped with the theoretical knowledge to build a secure login system.

Key Takeaways:

• Password Hashing: Never store passwords in plain text. Always store a salted, computationally expensive hash of the password. Algorithms like bcrypt or scrypt are the standard.
• One-Way Function: Hashing is a one-way street; you can't retrieve the original password from its hash.
• Salting: A unique, random salt for each user defeats rainbow table attacks and ensures that even identical passwords have different hashes.
• Session-Based Authentication: A mechanism to maintain user state across multiple HTTP requests. The server stores session data and gives the client a cookie with a Session ID to identify itself.
• Flask-Login: A Flask extension that handles the complexities of session management for you, allowing you to focus on your application logic.

In our next lesson, we will put this all into practice. We will take our forms from the previous lesson and use Flask-Login to implement user registration, login, logout, and protected routes. Get ready to build a complete and secure authentication system