Implementation of Password Security with bcrypt Hashing

Database/userdatahandler.py

@@ -1,8 +1,7 @@
 from datetime import datetime, timedelta
 import re
-
+import bcrypt
 from flask import session
-
 from Database import DatabaseConfig
 
 
@@ -12,12 +11,15 @@
 # Create user in MongoDB
 def create_user(firstname: str, lastname: str, email: str, username: str, password: str, accountcreatedtime: datetime):
 
+    # Hash the password before storing
+    salt = bcrypt.gensalt()
+    hashed_password = bcrypt.hashpw(password.encode('utf-8'), salt)
     user_data = {
         "first_name" : firstname,
         "last_name" : lastname,
         "mail_id" : email,
         "username" : username,
-        "password" : password,
+        "password" : hashed_password,
         "account_created_at" : accountcreatedtime,
         "role" : "user"
     }
@@ -56,7 +58,7 @@ def get_password_by_username(username: str):
     if user:
         return user.get("password")
     else:
-        return "user not found!"
+        return None
 
 # Get user by username from MongoDB
 def get_user_by_username(username: str):

app.py

@@ -18,6 +18,7 @@
 from werkzeug.utils import secure_filename
 import fitz  
 from PIL import Image
+import bcrypt
 
 
 from Database.admindatahandler import check_admin_available, create_admin, is_admin
@@ -109,12 +110,22 @@ def login():
         username = request.form['username']
         password = request.form['password']
         stored_password = get_password_by_username(username)
-        if stored_password == password:
-            session['username'] = username  # Store the username in session
-            flash('Login successful!', 'success')
-            return redirect(url_for("profile"))
-        else:
-            flash('Invalid credentials, please try again.', 'danger')
+
+        if stored_password:
+            # Check if stored password is hashed
+            if isinstance(stored_password, bytes) and stored_password.startswith(b'$2b$'):
+                # Handle hashed password
+                is_valid = bcrypt.checkpw(password.encode('utf-8'), stored_password)
+            else:
+                # For plain text password
+                is_valid = (stored_password == password)
+
+            if is_valid:
+                session['username'] = username
+                flash('Login successful!', 'success')
+                return redirect(url_for("profile"))
+
+        flash('Invalid credentials, please try again.', 'danger')
     return render_template("login.html")
 
 # Register a new user