FastAPI Authentication and Security with OAuth2 and JWT

In the previous lesson, we explored how to integrate NoSQL databases like MongoDB with FastAPI. We learned how to store and retrieve data efficiently, which is crucial for building scalable data science applications. Now, we’ll dive into a critical aspect of API development: authentication and security. Without proper security measures, your APIs are vulnerable to attacks, which can compromise sensitive data. In this lesson, we’ll implement OAuth2 and JWT-based authentication in FastAPI and discuss how to protect your APIs from common threats.

Securing a Data Science API

Imagine you’ve built a FastAPI application that predicts customer churn for an e-commerce platform. The API processes sensitive customer data, and only authorized users should access it. I faced a similar challenge when developing an API for a healthcare startup. Unauthorized access could lead to data breaches, so I implemented OAuth2 and JWT to ensure only authenticated users could interact with the API. This not only secured the application but also improved user trust.

Setting Up OAuth2 with FastAPI

FastAPI makes it easy to implement OAuth2 for authentication. OAuth2 is a widely-used standard that allows users to log in securely without sharing their credentials directly. To get started, install the required libraries:

pip install fastapi uvicorn python-jose[cryptography] passlib[bcrypt]

Next, create a security.py file to handle OAuth2 password flow. Here’s an example:

from fastapi.security import OAuth2PasswordBearer
from fastapi import Depends, HTTPException, status
from jose import JWTError, jwt
from datetime import datetime, timedelta

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

SECRET_KEY = "your-secret-key"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

def create_access_token(data: dict):
    to_encode = data.copy()
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    to_encode.update({"exp": expire})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt

This code sets up OAuth2 and generates JWT tokens for authenticated users.

Implementing JWT Token Authentication

JWT (JSON Web Tokens) is a compact way to securely transmit information between parties. In FastAPI, you can use JWT to authenticate users. Here’s how to verify tokens:

async def get_current_user(token: str = Depends(oauth2_scheme)):
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        username: str = payload.get("sub")
        if username is None:
            raise credentials_exception
    except JWTError:
        raise credentials_exception
    return username

This function decodes the JWT token and retrieves the user’s information. If the token is invalid, it raises an error.

Protecting APIs from Common Threats

Securing your API goes beyond authentication. You must also protect against threats like SQL injection, cross-site scripting (XSS), and brute force attacks. FastAPI provides built-in tools to mitigate these risks. For example, use dependency injection to enforce authentication on specific routes:

from fastapi import FastAPI, Depends

app = FastAPI()

@app.get("/protected-route/")
async def protected_route(current_user: str = Depends(get_current_user)):
    return {"message": f"Hello, {current_user}! This is a protected route."}

This ensures only authenticated users can access the /protected-route/ endpoint.

Testing Your Secure API

After implementing authentication, test your API to ensure it works as expected. Use tools like Postman or FastAPI’s built-in Swagger UI to simulate requests. For example, send a POST request to the /token endpoint with your credentials to receive a JWT token. Then, use this token to access protected routes.

Conclusion

In this lesson, we covered how to add FastAPI authentication and security using OAuth2 and JWT. We also discussed how to protect your APIs from common threats. By following these steps, you can build secure data science applications that protect sensitive data and ensure user trust. In the next lesson, we’ll explore optimizing and deploying FastAPI for production, which will help you scale your applications efficiently.