log in system backend.

imanipourmeysa

Hi everyone,
I am trying to make a Qt inventory application project for learning purpose.
I recently learned some basic of Qt (core and widget) and I have c++ background.
I have a question about the application design specifically regarding the sign-in part.

I want to user to be able to sign-in based on username, and password.
so at first, I thought that I can make a create account form which gets the username and password in a QMap container, and later I use that QMap to check if they are correctly filled to allow log-in in the inventory application dashboard.

However, I am new to software development and I want to know in real world application what should I do rather than using QMap.
I know I should not use file to store the username, and password in a file.
what do you suggest.
is the SQL the right choice, or not.
later each user (with specific username, and password), can have access to their specific inventory application and their own specific database.

Thanks a lot for your guide and feedback.

SGaist

I am fully aware that you are developing a desktop application. This does not mean it should not access a remote service.
If you want to build your skills, I would consider not dumping that part. Implement it in a later stage but don't drop it.
Typically an inventory application will make use a of centralized storage so that all users can access the same information.
You can either do it using a database or a web service in front of a database.

Pl45m4

@imanipourmeysa

Hi,

yes, a login dialog is reasonable. There you can use a QLineEdit with its Password mode to display input as dots.

I know I should not use file to store the username, and password in a file.

You can. On e.g. Linux everything is a file ;-)
But of course you should not store it as plaintext
Use for example QCryptograhicHash and hash the input in the same way using the same algo.
Store the hash in an SQL DB (using the QSQL Module)

https://doc.qt.io/qt-6/qcryptographichash.html

Edit:

The hash algos in QCrytographicHash are not very safe for passwords, at least not for actual SOTA security.
You can still use it in your project to prove the point and to have some security.
For actual passwords you need something like Argon (available via thirdparty lib) which adds salt to your key and is AFAIK slow to make brute forcing attacks harder.

SGaist

Hi,

Some details are missing:

Are you writing both the client and the server with Qt ?
Do you already have the backend working ?

If you want to do both with Qt, then I would recommend checking the cutelyst project for the backend part.

If you want to broaden your knowledge, then maybe something like Django, which is in Python, for the backend part might simplify your life for getting started as all the users/password management is included there.

imanipourmeysa

@Pl45m4
Thank you for the advices.

imanipourmeysa

Hi,

My purpose is to learn Qt, and I considered this project (inventory management app) to do in Qt.
However, it comes to my mind, that I even may not need a log-in system.
If I am developing a desktop application (not a web app), then I may not need to have log in.
I am trying to do an application, as portfolio and learning purpose, so I can get a job in C++/Qt, and I considered this project.

thanks for your responses, they guided me.

SGaist

I am fully aware that you are developing a desktop application. This does not mean it should not access a remote service.
If you want to build your skills, I would consider not dumping that part. Implement it in a later stage but don't drop it.
Typically an inventory application will make use a of centralized storage so that all users can access the same information.
You can either do it using a database or a web service in front of a database.

ZNohre

Coming from a C++ background I remember having the same question when I first started building my knowledge in Qt. It seemed like such a simple issue had such a steep learning curve if I wanted something even resembling a "real-world" login screen with user authentication.

As you're layering in knowledge of backend programming and learning app development (especially if you're interested in creating inventory applications that live in the real world), I would point you to the below REST API framework I wish I had known earlier. You mention:

@imanipourmeysa said in log in system backend.:

is the SQL the right choice, or not.

No. If you're relying on direct SQL login and access from Qt you're exposing your database to every user, making it easy to bypass your UI and modify data. In a real-world implementation it also forces you to open your database on the network, which is unsafe. A Web API fixes this by acting as a controlled gateway: Qt sends simple HTTP requests, and only the backend touches SQL.

Qt Desktop App - Contains the user interface and functions as a client to your backend database via a Web API. The desktop app will contain some form of ApiClient class. This is the C++ interface for login/authentication, as well as all database operations (add, update, delete). A simple ApiClient example for you might be:

struct LoginResponse
{
    QString token;
};

class ApiClient : public QObject
{
    Q_OBJECT

public:
    explicit ApiClient(QObject* parent = nullptr);

    // User authentication
    QFuture<LoginResponse> login(const QString& username, const QString& password);

    // Inventory API calls
    QFuture<QVector<InventoryItem>> getInventory(const InventoryFilter &f);
    QFuture<InventoryItem> createInventory(const InventoryItem& i);
    QFuture<InventoryItem> updateInventory(int id, const InventoryItem& i);
    QFuture<void> deleteInventory(int id);

private:
    QString m_token;
    QNetworkAccessManager m_manager;

    QNetworkRequest buildRequest(const QString& path) const;
};

The actual login code might look something like this:

QFuture<LoginResponse> ApiClient::login(const QString& username, const QString& password)
{
    QPromise<LoginResponse> promise;
    auto future = promise.future();

    QJsonObject payload;
    payload["username"] = username;
    payload["password"] = password;

    QNetworkRequest req = buildRequest("/login");
    QByteArray body = QJsonDocument(payload).toJson();

    QNetworkReply* reply = m_manager.post(req, body);

    QObject::connect(reply, &QNetworkReply::finished, this,
                     [this, reply, promise = std::move(promise)]() mutable
                     {
                         reply->deleteLater();

                         if (reply->error() != QNetworkReply::NoError) {
                             promise.setException(std::make_exception_ptr(
                                 std::runtime_error(reply->errorString().toStdString())));
                             promise.finish();
                             return;
                         }

                         const QJsonDocument doc = QJsonDocument::fromJson(reply->readAll());
                         const QJsonObject obj = doc.object();

                         LoginResponse r;
                         r.token = obj["token"].toString();

                         this->setToken(r.token);

                         promise.addResult(r);
                         promise.finish();
                     });

    return future;
}

Web API - The backend service your Qt app talks to — it handles authentication, business rules, and all database access. Instead of Qt connecting directly to SQL, the Qt client sends JSON over HTTP to the API, which returns structured responses like login tokens or inventory data.

I'm using a Windows environment so the ASP.NET code for the backend login endpoint might look like:

app.MapPost("/login", async (
    LoginRequest req,
    AppDbContext db,
    PasswordHasher hasher,
    JwtTokenFactory tokenFactory) =>
{
    var user = await db.Users
        .Where(u => u.Username == req.Username && u.IsActive)
        .SingleOrDefaultAsync();

    if (user == null)
        return Results.Unauthorized();

    if (!hasher.VerifyPassword(req.Password, user.PasswordHash, user.PasswordSalt))
        return Results.Unauthorized();

    var token = tokenFactory.CreateToken(user.Username, user.IsAdmin);
    return Results.Ok(new LoginResponse(token));
});

SQL Server - the database where your application’s data actually lives, and the Web API is responsible for reading and writing to it. You can run your favorite SQL server locally, create tables for users and inventory, and let your API expose safe, authenticated endpoints that your Qt app consumes.

A simple SQL User table that the login API interfaces with might be:

CREATE TABLE dbo.Users
(
    Id              INT             NOT NULL IDENTITY(1,1),
    Username        NVARCHAR(100)   NOT NULL,
    PasswordHash    VARBINARY(256)  NOT NULL,
    PasswordSalt    VARBINARY(128)  NOT NULL,
    CreatedAtUtc    DATETIME2(7)    NOT NULL,
    IsActive        BIT             NOT NULL,
    IsAdmin         BIT             NOT NULL,
);

With some basic AI prompts it's more straightforward than you might think to get a basic real-world implementation setup here to start playing with.

The younger version of myself would have hated the length of this post ("you mean I have to learn SQL, C#, API configuration, etc. IN ADDITION to the Qt framework??"). Yes, and it's not so bad :)