FLASK Backend API
I built a Flask API that creates accounts, verifies credentials, and uses signed tokens to control access to protected actions.
The project gave me a way to explore how a backend verifies identity, stores credentials, and decides what each user can do
Signed tokens · HMAC-SHA256 signing and verification, with Base64URL encoding.
Password handling · Per-user salts, SHA-256 hashing, and password complexity checks.
Database access · Parameterized SQLite queries keep user input separate from SQL commands.
Permissions · User and moderator roles determine who can perform restricted actions.
I came back to this project with a question I could test in code. What does the server need to verify before it lets someone act on an account? The API checks the token to establish who’s making the request, then checks whether that person has permission to take the requested action
/create • Create an account
The API validates the registration details before saving a new account in SQLite
/view • View an account with credentials
The caller sends a username and password. Once the API verifies those credentials, it returns the account’s profile information
/view-jwt • View an account with a signed token
The caller sends a signed token to retrieve the same profile. The API verifies the token before returning the account information
Request body
Signed token • <example-token>
/update • Update an account
Request body
{“username”: “demo_user", “password": “examplePass42!"}
Response body
{“username”: “demo_user", “email": “demo@example.com"}
{“message": “Account created"}
Request body
{“username": “demo_user", “password": “examplePass42!"}
Response body
{“username": “demo_user", “email": “demo@example.com"}
Response body
Before saving an account change, the API checks whether the caller has permission to make it
Example response body
{“message": “Account updated"}
{“message": “Permission denied"}
Scenario
Caller is allowed to change the account’s email
Caller lacks permission to make the same change