feat: jwt_backends - create backend mechanism and add authlib support #41

hasB4K · 2024-02-27T01:04:53Z

I've implemented the changes discussed in issue #40. The idea is to add a JWTBackend concept to fastapi-jwt for better security and customization. This allows using other authentication libraries besides python-jose, addressing the security concerns mentioned in #40.

Here's what's new in this PR:

A jwt_backends folder with PythonJoseJWTBackend and AuthlibJWTBackend.
A dynamic import system in jwt_backends/__init__.py.
A define_default_jwt_backend function, so users can pick their preferred backend. I think most will either stick with the default or set it once.
I've kept python-jose support for now, given its popularity, but we might want to consider a deprecation warning.

I think this approach could also help with:

Proposal to add a custom message for expired signature and incorrect token #7: making it easier to create custom backends.
Support standard JWT payload #26: allowing decode_kwargs customization and the "subject" to "sub" swap. Though, standardizing on "sub" might be simpler, that's a side point.

I hope this PR helps.

Have a great week!
Kind regards,

hasB4K · 2024-02-27T01:55:05Z

fastapi_jwt/jwt.py

@@ -72,28 +83,26 @@ def __init__(
        secret_key: str,
        places: Optional[Set[str]] = None,
        auto_error: bool = True,
-        algorithm: str = jwt.ALGORITHMS.HS256,  # type: ignore[attr-defined]
+        algorithm: Optional[str] = None,


default algorithm is now handled in the jwt backend directly.

hasB4K · 2024-02-27T01:57:00Z

fastapi_jwt/jwt.py

-    def _decode(self, token: str) -> Optional[Dict[str, Any]]:
-        try:
-            payload: Dict[str, Any] = jwt.decode(
-                token,
-                self.secret_key,
-                algorithms=[self.algorithm],
-                options={"leeway": 10},
-            )
-            return payload
-        except jwt.ExpiredSignatureError as e:  # type: ignore[attr-defined]
-            if self.auto_error:
-                raise HTTPException(
-                    status_code=HTTP_401_UNAUTHORIZED, detail=f"Token time expired: {e}"
-                )
-            else:
-                return None
-        except jwt.JWTError as e:  # type: ignore[attr-defined]
-            if self.auto_error:
-                raise HTTPException(
-                    status_code=HTTP_401_UNAUTHORIZED, detail=f"Wrong token: {e}"
-                )
-            else:
-                return None
-


This was moved in the backend PythonJoseJWTBackend. Since the error strings are now in the backend, a dev could create its own backend to customize the error handling like thhis PR wanted to do: #7

hasB4K · 2024-02-27T01:58:29Z

fastapi_jwt/jwt_backends/abstract_backend.py

+    def __new__(cls, algorithm) -> Self:
+        instance_key = (cls, algorithm)
+        if instance_key not in cls._instances:
+            cls._instances[instance_key] = super(AbstractJWTBackend, cls).__new__(cls)
+        return cls._instances[instance_key]


A simple SingletonArgs to handle the JWTBackend based on their implementation and the algorithm used. Useful to avoid recreating a lot of backends for nothing.

hasB4K · 2024-02-27T01:58:57Z

fastapi_jwt/jwt_backends/authlib_backend.py

+        return "HS256"
+
+    def encode(self, to_encode, secret_key) -> str:
+        token = self.jwt.encode(header={"alg": self.algorithm}, payload=to_encode, key=secret_key)


authlib doesn't auto add the alg header 🤷‍♂️ - manually adding it

hasB4K · 2024-02-27T02:00:05Z

pyproject.toml

+authlib = [
+    "Authlib >=1.3.0"
+]
+python_jose = [
+    "python-jose[cryptography] >=3.3.0"
+]


useful for people to be able to do:

pip install fastapi-jwt[authlib]

or

pip install fastapi-jwt[python_jose]

hasB4K · 2024-02-27T02:00:38Z

fastapi_jwt/jwt.py

+if AuthlibJWTBackend is not None:
+    define_default_jwt_backend(AuthlibJWTBackend)
+elif PythonJoseJWTBackend is not None:
+    define_default_jwt_backend(PythonJoseJWTBackend)


Authlib is the default if both authlib and python-jose are installed.

hasB4K · 2024-02-27T02:03:50Z

tests/test_security_jwt_general_optional.py

+@pytest.mark.parametrize("jwt_backend", [AuthlibJWTBackend, PythonJoseJWTBackend])
+def test_security_jwt_access_token_expiration(mocker: MockerFixture, jwt_backend):
+    client, _ = create_example_client(jwt_backend)
    access_token = client.post("/auth").json()["access_token"]

-    mocker.patch("jose.jwt.datetime", _FakeDateTimeShort)  # 3 min left
-
+    mock_now_for_backend(mocker, jwt_backend, minutes=3)  # 3 min left
    response = client.get(
        "/users/me", headers={"Authorization": f"Bearer {access_token}"}
    )
    assert response.status_code == 200, response.text
    assert response.json() == {"username": "username", "role": "user"}

-    mocker.patch("jose.jwt.datetime", _FakeDateTimeLong)  # 42 days left
-
+    mock_now_for_backend(mocker, jwt_backend, days=42)  # 42 days left


all the tests changes are about:

make it parametrize to test the two backends

mock datetime.now or time.time depending of the backend used (if necessary)

create a client depending of the backend used (need to be dynamic and wrapped inside a create_example_client to really test the backends, since a JWTBackend is created when JwtAccessBearer is created

hasB4K · 2024-02-27T02:04:21Z

tests/test_security_jwt_general_optional.py

-def test_security_jwt_custom_jti():
+@pytest.mark.parametrize("jwt_backend", [AuthlibJWTBackend, PythonJoseJWTBackend])
+def test_security_jwt_custom_jti(jwt_backend):
+    client, unique_identifiers_database = create_example_client(jwt_backend)


and for two tests we need to expose unique_identifiers_database with the client

rjjanuary · 2024-04-24T21:56:07Z

I'm looking at moving to JWT's for a few FastAPI projects and was considering building my own framework. Looking through fastapi-jwt, I love the design, however also feel that it's not in our best interest to rely on python-jose. Has there been any consideration of merging this into the project? If so, is there any additional work needed I could assist with?

hasB4K · 2024-04-25T10:38:51Z

@rjjanuary, it seems that the maintainer of this project is not very active.
Regarding this PR, I don't think it will be merged, and tbh I would be in favor of a full deprecation of python-jose entirely.

I'm now using fastapi-users which provide an auth framework in which you can select what you want and what you want to change. The project is actively maintained too. They had a similar issue with passlib being unmaintained, and the maintainer of fastapi-users handled the situation very well. See: fastapi-users/fastapi-users#1325

rjjanuary · 2024-04-25T13:25:21Z

Thank you @hasB4K, I appreciate the quick response. I'll look deeper into fastapi-users, however at first glance it may be a little overkill for current projects.

codecov · 2024-05-06T10:15:32Z

Codecov Report

Attention: Patch coverage is 98.01980% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 99.08%. Comparing base (19c6038) to head (57b463b).

Files	Patch %	Lines
fastapi_jwt/jwt.py	94.59%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##              main      #41      +/-   ##
===========================================
- Coverage   100.00%   99.08%   -0.92%     
===========================================
  Files            2        6       +4     
  Lines          158      219      +61     
===========================================
+ Hits           158      217      +59     
- Misses           0        2       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

k4black · 2024-05-06T11:18:27Z

@hasB4K Thank you for the great contribution!
Sorry for not being really active, if you eager to use and update this project i can grant you rights. Please write me email at kdchernyshev at gmail dot com and we can have a short call.

Regarding your contribution:
I'll update backends structure a bit to make jwt.py make a backend choice. For now i'll keep backends feature, but in general I agree with deprecation and removal of jose.

hasB4K force-pushed the authlib_backend branch 3 times, most recently from 722c988 to 2d61588 Compare February 27, 2024 01:41

hasB4K commented Feb 27, 2024

View reviewed changes

hasB4K force-pushed the authlib_backend branch from 2d61588 to 49e10c0 Compare February 27, 2024 02:06

jwt_backends: create backend mechanism and add authlib support

06d3132

hasB4K force-pushed the authlib_backend branch from 49e10c0 to 06d3132 Compare February 27, 2024 02:09

Merge branch 'main' into authlib_backend

54594f9

k4black self-requested a review May 6, 2024 10:17

style: multiple style fixes including typings

ea60e91

k4black changed the title ~~jwt_backends: create backend mechanism and add authlib support~~ feat: jwt_backends - create backend mechanism and add authlib support May 6, 2024

fix: remove unused typings Self import

93cbdee

k4black added 3 commits May 6, 2024 14:08

refactor: backends design + tests

ad4221d

chore: add # pragma: no cover where needed

67866bf

docs: update README.md

57b463b

k4black merged commit 0ea6c04 into k4black:main May 6, 2024
6 of 8 checks passed

k4black removed their request for review May 6, 2024 13:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: jwt_backends - create backend mechanism and add authlib support #41

feat: jwt_backends - create backend mechanism and add authlib support #41

hasB4K commented Feb 27, 2024

hasB4K Feb 27, 2024

hasB4K Feb 27, 2024

hasB4K Feb 27, 2024

hasB4K Feb 27, 2024 •

edited

Loading

hasB4K Feb 27, 2024 •

edited

Loading

hasB4K Feb 27, 2024

hasB4K Feb 27, 2024 •

edited

Loading

hasB4K Feb 27, 2024

rjjanuary commented Apr 24, 2024

hasB4K commented Apr 25, 2024

rjjanuary commented Apr 25, 2024

codecov bot commented May 6, 2024 •

edited

Loading

k4black commented May 6, 2024

feat: jwt_backends - create backend mechanism and add authlib support #41

feat: jwt_backends - create backend mechanism and add authlib support #41

Conversation

hasB4K commented Feb 27, 2024

hasB4K Feb 27, 2024

Choose a reason for hiding this comment

hasB4K Feb 27, 2024

Choose a reason for hiding this comment

hasB4K Feb 27, 2024

Choose a reason for hiding this comment

hasB4K Feb 27, 2024 • edited Loading

Choose a reason for hiding this comment

hasB4K Feb 27, 2024 • edited Loading

Choose a reason for hiding this comment

hasB4K Feb 27, 2024

Choose a reason for hiding this comment

hasB4K Feb 27, 2024 • edited Loading

Choose a reason for hiding this comment

hasB4K Feb 27, 2024

Choose a reason for hiding this comment

rjjanuary commented Apr 24, 2024

hasB4K commented Apr 25, 2024

rjjanuary commented Apr 25, 2024

codecov bot commented May 6, 2024 • edited Loading

Codecov Report

k4black commented May 6, 2024

hasB4K Feb 27, 2024 •

edited

Loading

hasB4K Feb 27, 2024 •

edited

Loading

hasB4K Feb 27, 2024 •

edited

Loading

codecov bot commented May 6, 2024 •

edited

Loading