0

All the registered ids are not able to log in. Even though the username and password are correct the website returns 400 error

def login():
"""Log user in"""

# Forget any user_id
session.clear()

# User reached route via POST (as by submitting a form via POST)
if request.method == "POST":

    # Ensure username was submitted
    if not request.form.get("username"):
        return apology("must provide username", 400)

    # Ensure password was submitted
    elif not request.form.get("password"):
        return apology("must provide password", 400)

    # Query database for username
    rows = db.execute("SELECT * FROM users WHERE username = :username", username=request.form.get("username"))

    # Ensure username exists and password is correct
    if len(rows) != 1 or not check_password_hash(rows[0]["hash"], request.form.get("password")):
        return apology("invalid username and/or password", 400)

    # Remember which user has logged in
    session["user_id"] = rows[0]["id"]

    # Redirect user to home page
    return render_template("index.html", 200)

# User reached route via GET (as by clicking a link or via redirect)
else:
    return render_template("login.html")

Here is the register function:-

def register():
"""Register user"""

# Forget any user id
session.clear()

# user reached via post
if request.method == "POST":

    # ensure username was submitted
    if not request.form.get("username"):
        return apology("must provide username", 400)

    # esnure password was submitted
    elif not request.form.get("password"):
        return apology("must provide password", 400)

    # ensure password was confirmed
    elif not request.form.get("confirmation"):
        return apology("must confirm password", 400)

    #ensure password matches
    elif request.form.get("confirmation") != request.form.get("password"):
        return apology("password and confirmation do not match", 400)

    # Query database for username and password
    hashp = generate_password_hash("password")
    result = db.execute("INSERT INTO users (username,hash) VALUES (:username, :hash)", username=request.form.get("username"), hash=hashp)
    if not result :
        return apology("user exists", 400)

    rows = db.execute("SELECT * from users WHERE username = :username", username = request.form.get("username"))
    session["user_id"] = rows[0]["id"]

    return redirect("/")

else:
    return render_template("register.html")
1

Try any user with the password password. All users are created with that same password.

This hashp = generate_password_hash("password") treats password as a string literal, because of the ". You probably meant the password that was submitted with the form.

1
  • yupp, that was the issue! Thanks Aug 31 '18 at 15:07
0

oh, thank you I have the same problem.

1
  • 1
    This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review
    – Cliff B
    Feb 2 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .