Flask 8（数据安全）

怼烎@ 2023-10-08 12:04 11阅读 0赞

#### Flask 数据安全 ####

*   *  1、哈希加密用户密码
     *   *  1.1、建立模型
         *  1.2、新建注册登录html
         *  1.3、路由
         *  1.4、运行并访问
     *  2、改进
     *  3、登录错误信息传递

### 1、哈希加密用户密码 ###

以用户注册登录为例

#### 1.1、建立模型 ####

模型  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70]

class User(db.Model):
        id = db.Column(db.Integer, primary_key=True, autoincrement=True)
        u_name = db.Column(db.String(16), unique=True)
        u_password = db.Column(db.String(256))

迁移

python manage.py db migrate
    python manage.py db upgrade

#### 1.2、新建注册登录html ####

注册  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 1]

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>用户注册页面</title>
    </head>
    <body>
    <form action="{
        { url_for('blue.user_register') }}" method="post">
        <span>用户名</span><input type="text" name="username" placeholder="请输入用户名">
        <br>
        <span>密码</span><input type="password" name="password" placeholder="请输入密码">
        <br>
        <button>注册</button>
    </form>
    </body>
    </html>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 2]

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>用户注册页面</title>
    </head>
    <body>
    <form action="{
        { url_for('blue.user_login') }}" method="post">
        <span>用户名</span><input type="text" name="username" placeholder="请输入用户名">
        <br>
        <span>密码</span><input type="password" name="password" placeholder="请输入密码">
        <br>
        <button>登录</button>
    </form>
    </body>
    </html>

#### 1.3、路由 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 3]

@blue.route('/user/register/', methods=["GET", "POST"])
    def user_register():
        if request.method == "GET":
            return render_template('UserRegister.html')
        elif request.method == "POST":
            username = request.form.get("username")
            password = request.form.get("password")
            # 哈希加密用户密码
            # from werkzeug.security import generate_password_hash
            hash_pwd = generate_password_hash(password)
            user = User()
            user.u_name = username
            user.u_password = hash_pwd
            db.session.add(user)
            db.session.commit()
            return redirect(url_for('blue.user_login'))
            # return '注册成功'
    
    
    @blue.route('/user/login/', methods=["GET", "POST"])
    def user_login():
        if request.method == "GET":
            return render_template('UserLogin.html')
        elif request.method == "POST":
            username = request.form.get("username")
            password = request.form.get("password")
            user = User.query.filter(User.u_name.__eq__(username)).first()
            # 验证密码
            if user and check_password_hash(user.u_password, password):
                return "登录成功"
            return '登录失败'

#### 1.4、运行并访问 ####

![在这里插入图片描述][20200228230720368.png]  
![在这里插入图片描述][20200228231813438.png]  
![在这里插入图片描述][20200228232911517.png]  
查看数据库  
![在这里插入图片描述][20200228233323569.png]

### 2、改进 ###

把密码验证封装到模型中  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 4]

class User(db.Model):
        id = db.Column(db.Integer, primary_key=True, autoincrement=True)
        u_name = db.Column(db.String(16), unique=True)
        _u_password = db.Column(db.String(256))
    
        # python3中的property有一个很有意思的功能，它能将类中的方法像类属性一样调用！
        # 它只能有self参数
        # 那么如果想访问属性可以通过属性的getter（访问器）和setter（修改器）方法进行对应的操作.
    
        # 将密码变成私有方法
        @property
        def u_password(self):
            raise Exception("密码不可访问")
    
        # 每次调用u_password自动加密_u_password后赋值
        @u_password.setter
        def u_password(self, v):
            self._u_password = generate_password_hash(v)
    
        # 验证密码时调用
        def check_password(self, password):
            return check_password_hash(self._u_password, password)

修改视图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 5]

@blue.route('/user/register/', methods=["GET", "POST"])
    def user_register():
        if request.method == "GET":
            return render_template('UserRegister.html')
        elif request.method == "POST":
            username = request.form.get("username")
            password = request.form.get("password")
    
            user = User()
            user.u_name = username
            # 这里调用u_password就自动加密了
            user.u_password = password
            db.session.add(user)
            db.session.commit()
            return redirect(url_for('blue.user_login'))
            # return '注册成功'
    
    
    @blue.route('/user/login/', methods=["GET", "POST"])
    def user_login():
        if request.method == "GET":
            return render_template('UserLogin.html')
        elif request.method == "POST":
            username = request.form.get("username")
            password = request.form.get("password")
            user = User.query.filter(User.u_name.__eq__(username)).first()
            # 验证密码
            if user and user.check_password(password):
                return "登录成功"
            return '登录失败'

迁移

python manage.py db migrate
    python manage.py db upgrade

删除数据库user表里原本的内容  
![在这里插入图片描述][20200229004130394.png]  
运行并访问  
![在这里插入图片描述][20200228230720368.png]  
![在这里插入图片描述][20200228231813438.png]  
![在这里插入图片描述][20200228232911517.png]

### 3、登录错误信息传递 ###

在对应的路由里写入flash（“ ”）  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 6]  
flash需要添加SECRET\_KEY，在setting里面添加SECRET\_KEY =“ ”，赋值越复杂越好  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 7]  
传递到html里

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 8]

{
        % for foo in get_flashed_messages() %}
    <span>{
        {
         foo }}</span>
    {
        % endfor %}

运行并访问:写错登录密码就会提示  
![在这里插入图片描述][20200229005835230.png]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200228122254235.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200228232931957.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200228232952883.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200228233130294.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[20200228230720368.png]: https://img-blog.csdnimg.cn/20200228230720368.png
[20200228231813438.png]: https://img-blog.csdnimg.cn/20200228231813438.png
[20200228232911517.png]: https://img-blog.csdnimg.cn/20200228232911517.png
[20200228233323569.png]: https://img-blog.csdnimg.cn/20200228233323569.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200229003855964.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200229003945318.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[20200229004130394.png]: https://img-blog.csdnimg.cn/20200229004130394.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20200229005910486.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20200229005645666.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/20200229005801521.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FfX2ludF9f,size_16,color_FFFFFF,t_70
[20200229005835230.png]: https://img-blog.csdnimg.cn/20200229005835230.png