Securing FastAPI with JWT Authentication (JSON Web Tokens)

FastAPI is a modern web framework for building APIs with Python. It is fast, easy to use, and provides native support for authentication using JSON Web Tokens (JWT). In this tutorial, we will walk through the process of setting up authentication with JWT in a FastAPI application.

What is JWT?
JSON Web Tokens (JWT) are a standard method for securely transmitting information between parties as a JSON object. They are compact, self-contained, and can be easily transmitted as a URL parameter, a cookie, or within an HTTP header. JWTs are commonly used for authentication and information exchange in web applications.

Setting up a FastAPI Application
First, let’s create a new FastAPI application and install the necessary dependencies:

pip install fastapi
pip install uvicorn
pip install pyjwt

Next, create a new Python file for your FastAPI application, for example main.py, and import the required modules:

from fastapi import FastAPI
from fastapi.security import OAuth2PasswordBearer
from pydantic import BaseModel
from typing import Optional
from datetime import datetime, timedelta
import jwt

Creating a User Model
Next, let’s define a user model using Pydantic to store user information. This model will be used for authentication and authorization:

class User(BaseModel):
    id: int
    username: str
    email: str
    password: str

In a real-world application, you would typically use a database to store user data and retrieve it when needed.

Generating JWT
We will now create a function to generate a JWT token when a user successfully logs in. The token will contain the user’s id and an expiration time:

def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
    to_encode = data.copy()
    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(hours=24)
    to_encode.update({"exp": expire})
    encoded_jwt = jwt.encode(to_encode, "SECRET_KEY", algorithm="HS256")
    return encoded_jwt

In a real-world scenario, you should store the SECRET_KEY securely and not hardcode it in your application.

Authenticating Users
Now, let’s create a route for user authentication where users can log in using their credentials:

app = FastAPI()

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    # Authenticate user
    user = authenticate_user(form_data.username, form_data.password)

    if not user:
        raise HTTPException(status_code=400, detail="Incorrect username or password")

    access_token = create_access_token(data={"sub": user.id})
    return {"access_token": access_token, "token_type": "bearer"}

In this route, we authenticate the user by checking their credentials against the database. If the credentials are correct, we generate a JWT token using the create_access_token function and return it to the user.

Protecting Routes
To protect routes with authentication, you can use the OAuth2PasswordBearer security dependency provided by FastAPI. Here’s an example of how you can use it to secure a route:

from fastapi import Depends
from fastapi.security import OAuth2PasswordBearer

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.get("/users/me")
async def read_users_me(token: str = Depends(oauth2_scheme)):
    # Verify token
    try:
        payload = jwt.decode(token, "SECRET_KEY", algorithms=["HS256"])
        user_id = payload.get("sub")
        user = get_user_by_id(user_id)
        if user is None:
            raise HTTPException(status_code=401, detail="Invalid token")
        return user
    except jwt.ExpiredSignatureError:
        raise HTTPException(status_code=401, detail="Token has expired")
    except jwt.InvalidTokenError:
        raise HTTPException(status_code=401, detail="Invalid token")

In this route, we use the OAuth2PasswordBearer dependency to extract the JWT token from the request header. We then decode the token using the jwt.decode function and verify its contents. If the token is valid, we return the user’s information.

Conclusion
In this tutorial, we have walked through the process of setting up authentication with JWT in a FastAPI application. By following these steps, you can secure your API endpoints and authenticate users effectively. FastAPI provides built-in support for authentication and authorization, making it easy to implement secure web applications.