🔒 Security Servers, Authentication, and Authorization

[frozen cosmos]

Hello. Right now, I am creating an API for an application. It is not a multiuser system, and doesn't need any profiles. I am planning on, in the future, working on projects that will be multi-user though. I have heard of the authentication frameworks through some neat videos, including the use of bearers with JWT, session cookies OAuth, OIDC, etc. How to organize these assets into code, however, is turning out to be quite confusing to me. I hear mentions of an "authentication/authroization server", but I am struggling to find explicit examples. This is my current impression of how it works, with FastAPI:

from typing import Annotation
from fastapi import FastAPI
from pydantic import BaseClass

app = FastAPI()

class Headers(BaseClass):
  user_name: str
  password: str
  access_token: str | None = None
  refresh_token: str | None = None
  session_cookies: str | None = None

@app.get('/resource/')
async def get_resource(
  headers: Annotation[Headers, Header()]
):
  #1. Call to the authentication server OR a stored program
  #2. Call to the authorization server OR a stored function 
  #3. Call code to handle the body of the data
  pass

[abstract shard]

@frozen cosmos

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[tranquil blade]

I went over this with a udemy course, let me see if I still have the reading materials around here somewhere

https://rest-apis-flask.teclado.com/docs/flask_jwt_extended/what_is_a_jwt/ maybe this will be helpful

[frozen cosmos]

maybe.

[frozen cosmos]

reading this really quickly, is the username and password typically held in the query? I thought it would be stored in the headers

@blp.route("/register")
class UserRegister(MethodView):
    @blp.arguments(UserSchema)
    def post(self, user_data):
        if UserModel.query.filter(UserModel.username == user_data["username"]).first():
           pass

also, do you have to do the functions every time you define an API end point? Meaning, every API call, we check for the access token using a simple if statement at the beginning?

[tranquil blade]

I think the header in a jwt is just bearer normally if I recall correctly but I could be way off, only went over that a couple times like a year ago

[frozen cosmos]

all good. I can easily go over the documentation, and use AI to translate it into a fastAPI version.

Do you have any idea how authentication works with streaming as well?

I know in a sense, we can have long lived http sessions, and start a stream

[tranquil blade]

no, i'm not even sure what that would mean

[frozen cosmos]

but does every message have to be authenticated?

[frozen cosmos]

oh, uhh

[tranquil blade]

I assume the authentication only occurs during the initial connection

[frozen cosmos]

streaming data events, such as a constant flow of information. Think voice to text commands generating text as you speak (streaming) vs only when the voice memo is finished (batch).

is what I mean

[tranquil blade]

yeah sorry, that material is pretty distant from my mind atm I couldn't say

[frozen cosmos]

all good. Its a problem I am going to have to tackle for my application.

[frozen cosmos]

cause this exact scenario which I am talking about is my project, taking voice input, and creating a stream of text as output to have a real time voice note taking tool.

I want the text to show up on the screen as the user is speaking, so they can choose to pause it whenever. That apparently needs streamed data.

but that is a diverging point. I really appreciate the document. It will help a lot later on in the project.

[frozen cosmos]

!close

[abstract shard]

Python help channel closed with !close

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.