Question

You are building a Flask-based network automation portal where engineers register accounts to trigger provisioning jobs. During a security review, a colleague notes that user login passwords are currently stored in the backing database as SHA-256 digests with no per-user salt. To meet secure coding requirements for authentication, which change should you implement for password storage?

Accepted Answer

Replace SHA-256 with a slow, salted adaptive hashing function such as Argon2 or bcrypt for storing password verifiers

Answer

Encrypt the SHA-256 digests with AES-256 using a key stored in an environment variable

Answer

Add a single application-wide static salt string before hashing with SHA-256

Answer

Store passwords as base64-encoded strings so they are not human-readable in the database