python - 这是登录某人的正确/安全方式吗？

Question

好吧，我对编程真的很陌生(今天刚刚学会了如何建立数据库连接并从中写入/读取)，我正在尝试创建一个基本站点，允许您登录用户，并有一些当用户登录时，页面会有所不同。我决定使用 Flask、Flask-session、Sqlite3 进行尝试，基本上身份验证如下:用户使用表单登录，表单数据根据中的信息进行检查sqlite3数据库，如果正确，则将相应的值写入CLIENT端cookie。这是一种可以接受的登录方式吗？请原谅我的无知，但我对编程真的很陌生，并且我缺少一些关键术语来在这里搜索我自己的答案。我已经四处搜索，但无法确定这是否是一种可接受的登录/退出方式。

我的网站可以运行，但我不知道我是否真的以传统意义上的方式登录或注销任何内容。另请注意，有些路线被奇怪地破坏或隐藏，这只是我试图破坏事物以了解它们如何工作的原因。为了让我的网站运行，我没有包含模板:

从 app.py 导入 init_db

init_db()

python app.py

这是我的应用程序文件:

#importations
import sqlite3
from flask import Flask, request, session, g, redirect, url_for, \
abort, render_template, flash, escape
from contextlib import closing
import sys
import datetime
from models import User
from formms import RegistrationForm, Login
import os


key1 = os.urandom(24)
#config
DATABASE = '/tmp/fitty1.db'
DEBUG = True
SECRET_KEY = key1
USERNAME = 'admin'
PASSWORD = 'default'
print key1

#Initialize the application
app = Flask(__name__)
app.config.from_object(__name__)

#login_manager = LoginManager()
#login_manager.init_app(app)




#Method to connect to database, use to open a connection on request, or from interactive python shell
def connect_db():
    return sqlite3.connect(app.config['DATABASE'])

#Run this before application to initialize the DB
def init_db():
    with closing(connect_db()) as db:
        with app.open_resource('schema.sql', mode='r') as f:
            db.cursor().executescript(f.read())
        db.commit()


def query_db(query, args=(), one=False):
    cur = get_db().execute(query, args)
    rv = cur.fetchall()
    cur.close()
    return (rv[0] if rv else None) if one else rv



@app.teardown_request
def teardown_request(exception):
    db = getattr(g, 'db', None)
    if db is not None:
        db.close()

@app.route('/')
def show_entries():
    g.db = connect_db()
    cur = g.db.execute('select title, text from entries order by id desc')
    entries = [dict(title=row[0], text=row[1]) for row in cur.fetchall()]
    return render_template('show_entries.html', entries=entries)


@app.route('/register', methods=['POST', 'GET'])
def register():
    g.db = connect_db()
    form = RegistrationForm(request.form)
    if request.method == 'POST' and form.validate():
        user = User(form.username.data, form.email.data, form.password.data)
        g.db.execute('insert into users (username, email, password) values (?, ?, ?)',
             [request.form['username'], request.form['email'], request.form['password']])
        g.db.commit()
        flash('Registered successfully')
        return redirect(url_for('show_entries'))
    return render_template('register.html', form=form)


@app.route('/account') 
def account():
    g.db = connect_db()
    if not session.get('logged_in'):
        abort(401)
    if 'username' in session:
        username = session['username']
        c = g.db.execute("SELECT password from users where username = (?)", (username,))
        passwc = c.fetchone()
        c = g.db.execute("SELECT text from entries")
        texty = c.fetchone()
        return 'Your username is "%s", your password is "%s" and code %s' % (username, passwc[0], texty[0])
    return 'You are not logged in'


@app.route('/add', methods=['POST'])
def add_entry():
    g.db = connect_db()
    if not session.get('logged_in'):
        abort(401)
    g.db.execute('insert into entries (title, text) values (?, ?)',
                 [request.form['title'], request.form['text']])
    g.db.commit()
    flash('New entry was successfully added')
    return redirect(url_for('show_entries'))

@app.route('/login', methods=['GET', 'POST'])
def login():
    g.db = connect_db()
    error = None
    form = Login(request.form)
    user = User(form.username.data, form.email.data, form.password.data)
    if request.method == 'POST':
        c = g.db.execute("SELECT username from users where username = (?)", [form.username.data])
        userexists = c.fetchone()
        if userexists:
            c = g.db.execute("SELECT password from users where password = (?)", [form.password.data])
            passwcorrect = c.fetchone()
            if passwcorrect:
                session['username'] = form.username.data
                session['logged_in'] = True
                flash('You were logged in')
                return redirect(url_for('account'))
            else:
                return 'password fail'
        else:
            return 'username fail'
    return render_template('login.html', form=form)


@app.route('/logout')
def logout():
    g.db = connect_db()
    session.pop('logged_in', None)
    flash('You were logged Out')
    return redirect(url_for('show_entries'))




#Use build in server to run standalone application
if __name__ == '__main__':
    app.run()

型号

import sqlite3
from flask import g
from flask.ext.login import LoginManager, login_required

class User():
    def __init__(self,username,email,password,active=True):
        self.username = username
        self.email = email
        self.password = password
        self.active = active

    def is_authenticated(self):
        return True
        #Return true if authenticated, provided credentials

    def is_active(self):
        return True

def is_anonymous(self):
    return False
    #return true if anon, actual user returns false


def __repr__(self):
    return '<User %r>' % (self.email)

架构.sql

drop table if exists entries;
create table entries (
  id integer primary key autoincrement,
  title text not null,
  text text not null
);
drop table if exists users;
create table users (
  id integer primary key autoincrement,
  username text not null,
  email text not null,
  password text not null
);

Answer 1

这绝对是正确的做法。客户端 cookie 允许您唯一地识别用户。您只需确保 cookie 足够随机，否则有人可能会欺骗它。

如果您给我的 cookie 是 uid=hailey 那会很糟糕，因为我可以轻松地将其编辑为 uid=ach1lles 并获得您的管理员访问权限。相反，你想要做一些足够随机的事情，比如我的用户名和当前时间以及昨天《纽约时报》的标题的 sha2 哈希的 Base64 或类似的疯狂事情。您可能希望将其添加为数据库表，然后在我发出请求时检查它。

此外，不要将密码存储为文本，请考虑使用 bcrypt 之类的内容。 :)