Aden1ke closed merge request !10: Add user authentication module with signup and login endpoints at GitLab AI Hackathon / Participants / Aden1ke

Aden1ke
2026-03-24T23:36:09Z

Fix approaches considered

Approach 1: Flask-Login integration

Use Flask-Login for session management

Requires additional dependency and complexity

More production-ready but heavier weight

Risk: Adds complexity, may introduce new vulnerabilities

Approach 2: Simple JWT-based auth module

Standalone auth.py module with JWT tokens

Uses bcrypt for password hashing (as specified in requirements)

Parameterized SQL queries (learned from app.py fixes)

Simple input validation

No hardcoded secrets (use environment variables)

Minimal dependencies (PyJWT, bcrypt)

Chosen: Approach 2 — because it directly addresses all security requirements in the issue, keeps dependencies minimal, and avoids repeating the SQL injection vulnerability that was previously fixed in app.py.

What this fixes

Closes #6

Root cause

The application had no authentication module, requiring implementation of secure signup and login endpoints with proper password hashing and SQL injection prevention.

Context Report

Last 3 related issues: None found (this is a new feature request)

Related commits: None found (first authentication implementation)

CVEs found in history:

CVE-2018-18074 in requirements.txt (requests library - pre-existing, not related to this fix)

Previous SQL injection vulnerability in app.py (already fixed with parameterized queries)

Implementation details

Created demo/broken_app/auth.py:

POST /auth/signup endpoint with username, email, password validation

POST /auth/login endpoint with JWT token generation

Bcrypt password hashing (salt rounds: default 12)

All SQL queries use parameterized statements to prevent SQL injection

Input validation rejects empty/missing fields

JWT secret from environment variable (no hardcoding)

Proper error handling with specific exception catching

Database initialization with users table schema

Updated demo/broken_app/requirements.txt:

Added bcrypt==4.1.2 for secure password hashing

Added PyJWT==2.8.0 for JWT token generation

Security features implemented

✅ Passwords hashed with bcrypt
✅ SQL queries use parameterized statements
✅ Input validation rejects empty fields
✅ No hardcoded secrets (JWT_SECRET from environment)
✅ Proper HTTP status codes (201, 400, 401, 409, 500)
✅ Specific exception handling (no bare except)
✅ Unique constraints on username and email

Testing recommendations

Set JWT_SECRET environment variable before running

Test signup with valid data (should return 201)

Test signup with duplicate username/email (should return 409)

Test signup with missing fields (should return 400)

Test login with valid credentials (should return JWT token)

Test login with invalid credentials (should return 401)

Verify JWT token can be decoded with the secret