cannot authenticate hashed password in Flask - mongodb

Question

I'm building username/password authentication for a flask app. When the user signs up, I store the username and password in a mongodb document.
This is my User model:
class User():
def __init__(self, userid=None,username=None,password=None):
self.userid= userid
self.username = username
self.password = generate_password_hash(password)
def __repr__(self):
return '<User %r>' % self.username
def is_authenticated(self):
return True
def is_active(self):
return True
def is_anonymous(self):
return False
def get_id(self):
try:
return unicode(self.userid)
except NameError:
return unicode(self.userid)
I'm using the werkzeug library methods generate_password_hash and check_password_hash to generate/check the password, respectively.
This is my code for dumping user data into mongodb:
def db_dump(data):
k = {'username':data.username,'password':data.password}
db.users.insert(k,True)
And this is my code for retrieving user data by username:
def find_by_username(username):
data = self.db.users.find_one({'username': username})
user = User(userid=unicode(data['_id']),username=data['username'],password=data['password'])
return user
Here's my problem. Let's say I have a user 'jon' that has a password 'abcd'. When I run the code to check the password hash for a new user thru the console, it works fine:
>> check_password_hash(generate_password_hash('abcd'),'abcd')
True
However, after 'jon' has signed up and his info has been dumped into the database, on a subsequent login attempt in which I have to retrieve the hashed password from the database, the checking doesn't work:
>>check_password_hash(find_by_username('jon').password,'abcd')
False
Any idea as to why this is happening? After some googling my first instinct is that maybe I need to store or retrieve the hash password in mongodb in a different way, since it seems like it's being stored as a string. Any ideas?

Answer 1

I believe the issue is that you are double-hashing the password when you instantiate the User object in your find_by_username method. That method grabs the info from the DB which would contain the hashed password. Then, it creates a User object with that data. The User object calls generate_password_hash during its __init__ method. So, the password is being double-hashed and therefore failing the check_password_hash check.
You might consider moving the password hashing to a function that is called when the User object is saved to the DB. You'd want to detect if the password has changed or not so you aren't repeatedly rehashing the password. There are likely other ways to handle this as well, but in short, you might want to move the password hashing out of the __init__ call.