Generating JWT Tokens for Authentication

What an amazing progress you've done so far! In previous lessons you learned how to authenticate users using query parameters and how to secure endpoints with dependency injection. While these methods are useful, they have limitations. Specifically, using query parameters to pass credentials is not secure. That's why in this lesson, we will introduce JSON Web Tokens (JWT) as a more secure and efficient way to handle authentication. By the end of this lesson, you will be able to generate JWT tokens and integrate them into your FastAPI application for authentication.

Understanding Bearer Tokens

Before we dive into JWT, let's understand Bearer Tokens . A bearer token is like a "movie ticket" that you present to gain entry. Whoever "bears" this token can access certain resources. Instead of sending your username and password with every request—which is risky—you log in once and receive a bearer token. This token is then included in the headers of future requests to prove your identity. JWT is a type of bearer token. By using tokens, you improve security and efficiency since your credentials are not repeatedly transmitted, and servers can quickly verify token validity.

What is JWT?

JWT stands for JSON Web Token, a compact and URL-safe way to transmit information securely between two parties. These tokens are commonly used in modern web applications to maintain secure communication. Instead of passing login credentials through query parameters—which can be easily intercepted—they provide a safer alternative. A JWT token consists of three parts: a Header, a Payload, and a Signature . The Header contains metadata about the token, such as the type and hashing algorithm used. The Payload carries the actual data or claims, like user information and token expiration time. The Signature ensures the token's integrity by verifying that the content hasn't been tampered with, using a secret key. By encoding this information, JWT protects user data and offers a reliable way to verify user identities.

How Does a Token Look Like?

JWTs are Base64Url encoded, making them compact and URL-safe. Here's an example: text eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc Header : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 Payload : eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0 Signature : NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc The payload can contain various claims, such as the user ID and an expiration time ("exp"). The signature ensures that the token hasn't been tampered with.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Creating the JWT Token

Now, let's create the function to generate JWT tokens. This function will encode user information and set an expiration time for the token:

Python

# Function to create JWT token with an expiration time
def create_access_token(data: dict):
    # Copy the provided data to avoid modifying the original
    to_encode = data.copy()
    # Set the token expiration time
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    # Add the expiration time to the token payload
    to_encode.update({"exp": expire})
    # Encode the token with the secret key and algorithm
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

# Function to create JWT token with an expiration time
def create_access_token(data: dict):
    # Copy the provided data to avoid modifying the original
    to_encode = data.copy()
    # Set the token expiration time
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    # Add the expiration time to the token payload
    to_encode.update({"exp": expire})
    # Encode the token with the secret key and algorithm
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

This function performs several crucial steps:

Copy the Data: The function begins by copying the provided data dictionary. This ensures that the original data is not modified during the token creation process.
Set Token Expiration: It calculates the token expiration time by adding the specified number of minutes (ACCESS_TOKEN_EXPIRE_MINUTES) to the current UTC time. This expiration time ensures that the token is only valid for a limited period.
Update Payload: The expiration time is added to the token's payload. This is done by updating the copied data dictionary (to_encode) to include a new key-value pair with "exp" as the key and the calculated expiration time as the value.
Encode the Token: Finally, the jwt.encode function from the jose library encodes the token. It takes three arguments: the payload (to_encode), the secret key (SECRET_KEY), and the hashing algorithm (ALGORITHM). The result is the encoded JWT token, which can be used for secure authentication in your FastAPI application.

Generating JWT Tokens for Authentication

Understanding Bearer Tokens

What is JWT?

How Does a Token Look Like?

Join the 1M+ learners on CodeSignal

Importing Essential Modules

Configuring JWT Settings

Creating the JWT Token

Setup Recap

Updated Authentication Function

Creating the Token Response Model

Implementing the Login Endpoint

Expected Response

Summary and Practices