fastapi-jwt-auth | FastAPI extension that provides JWT Auth support | Authentication library

by IndominusByte Python Version: 0.5.0 License: MIT

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | fastapi-jwt-auth Summary

fastapi-jwt-auth is a Python library typically used in Security, Authentication, Fastapi applications. fastapi-jwt-auth has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. However fastapi-jwt-auth build file is not available. You can install using 'pip install fastapi-jwt-auth' or download it from GitHub, PyPI.

FastAPI extension that provides JWT Auth support (secure, easy to use, and lightweight)

Support

Quality

Security

License

Reuse

Support

fastapi-jwt-auth has a low active ecosystem.

It has 514 star(s) with 101 fork(s). There are 7 watchers for this library.

It had no major release in the last 12 months.

There are 44 open issues and 36 have been closed. On average issues are closed in 20 days. There are 12 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of fastapi-jwt-auth is 0.5.0

Quality

fastapi-jwt-auth has 0 bugs and 0 code smells.

Security

fastapi-jwt-auth has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

fastapi-jwt-auth code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

fastapi-jwt-auth is licensed under the MIT License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

fastapi-jwt-auth releases are available to install and integrate.

Deployable package is available in PyPI.

fastapi-jwt-auth has no build file. You will be need to create the build yourself to build the component from source.

Installation instructions, examples and code snippets are available.

It has 3054 lines of code, 340 functions and 36 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed fastapi-jwt-auth and discovered the below as its top functions. This is intended to give you an instant insight into fastapi-jwt-auth implemented functionality, and help decide if they suit your requirements.

Authenticate a user
Create a token
Create an access token
Convert a datetime into an integer
Returns a partial auth token
Verify that the given token is optional
Verify a JWT signature
Verify a JWT token and verify it
Logout
Unset JWT cookies
Unset refresh cookies
Unset access cookies
Create a websocket connection
Verify that a JWT token is required
Get the raw JWT
Verify and return an AuthJWT
Refresh access token
Return the subject of the JWT
Verify a JWT refresh token
Provide access to items
Provide access token
Revoke access token
Gets cookie
Revoke a refresh token
Creates a fresh access token
Initialize a fresh JWT

Get all kandi verified functions for this library.

fastapi-jwt-auth Key Features

No Key Features are available at this moment for fastapi-jwt-auth.

fastapi-jwt-auth Examples and Code Snippets

No Code Snippets are available at this moment for fastapi-jwt-auth.

Community Discussions

Trending Discussions on fastapi-jwt-auth

Using Refresh Tokens as the Only External Access Token Given to the Client

QUESTION

Using Refresh Tokens as the Only External Access Token Given to the Client

Asked 2021-Dec-22 at 15:28

I'm now implementing a microservices-based architecture. I'm using FastAPI JWT Auth in my UsersService (the microservice for authentication and authorization) to generate the tokens, and basic JWT validation tools in every other microservice, to ensure that the JWT is legit (including direct access to the Revoked Tokens Redis on every one of them).

Currently, I'm using the suggested architecture, with access and refresh tokens.

I'm considering not exposing the JWT access tokens directly to the clients, and instead, implementing an API gateway that will convert the refresh tokens to JWTs on every request. The JWTs will be passed then to the internal microservices to ensure in-bounds security.

To do this, the client only needs access to the refresh tokens, as the regular JWTs (that will have an extremely short lifespan) are only used to authenticate and authorize the user internally. I plan to include all the permissions and scope information inside those JWTs, while the refresh token will only have a user payload.

I have 2 questions:

Will this architecture work? Is it secure?
Are there any recommended python frameworks to implement such an API Gateway?

Thank you very much! 😄

...

ANSWER

Answered 2021-Dec-22 at 15:28

That is not secure, as giving out the refresh token to the browser means that the client receiving the refresh token can ask for their own access token without going through your gateway.

A better approach is to only use a session cookie with the client (I assume a browser in your project).

Do take a look at this video https://www.youtube.com/watch?v=lEnbi4KClVw

The refresh token is only meant to be used by the client application requesting it and it is a bad practice in general to give it out to other clients/applications.

If you want to just have pure service-to-service communication ,you should look at using the client credentials flow, this flow does not use any refresh tokens and does not involve any human user. Perhaps that is what you are after? Then each client can get its own access token.

Source https://stackoverflow.com/questions/70443070

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install fastapi-jwt-auth

The easiest way to start working with this extension with pip. If you want to use asymmetric (public/private) key signing algorithms, include the asymmetric extra requirements.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: