Verifying JWT Tokens for Secure Access

Welcome back! In our previous lessons, you learned how to set up basic user authentication using FastAPI . You also explored how to secure endpoints using Dependency Injection and understood the importance of JSON Web Tokens (JWT) for secure authentication. Today, we’re going to build on those concepts and the progress you've made. Remember how we generated JWT tokens and returned them to the user upon login? Now, let’s take the next step: verifying these tokens to secure our API endpoints. By the end of this lesson, you'll be able to implement and verify JWT tokens in FastAPI, ensuring only authenticated users can access certain parts of your application. Let's dive in!

Setup from Previous Lesson

Before we move forward, let's quickly recap what we covered in the previous lesson, where we generated JWT tokens for authentication. Here's a snippet of the essential code you learned: Pythonfrom fastapi import FastAPI, HTTPException, Depends from fastapi.security import OAuth2PasswordRequestForm from pydantic import BaseModel from jose import JWTError, jwt from datetime import datetime, timedelta app = FastAPI() # Mock database with usernames and passwords users_db = {"user1": "pass1", "user2": "pass2"} # Configuration for JWT SECRET_KEY = "your_secret_key" ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 30 # Token class class Token(BaseModel): access_token: str token_type: str # Function to create JWT token with an expiration time def create_access_token(data: dict): to_encode = data.copy() expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) to_encode.update({"exp": expire}) return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) # Function to check if user exists in the database def authenticate_user(form_data: OAuth2PasswordRequestForm = Depends()): username = form_data.username password = form_data.password if users_db.get(username) == password: return {"username": username} raise HTTPException(status_code=401, detail="Incorrect username or password") # Login endpoint @app.post("/login", response_model=Token) async def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()): user = authenticate_user(form_data) access_token = create_access_token(data={"sub": user["username"]}) return {"access_token": access_token, "token_type": "bearer"} This code generated JWT tokens upon a successful login, which will be crucial for securing endpoints.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Verifying the Token

Now, let's dive into the logic of this function, which will decode and verify the JWT token:

Python

from jose import JWTError

async def get_current_user(token: str = Depends(oauth2_scheme)):
    try:
        # Decode and verify the JWT token
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        # Extract the username from the token payload
        username: str = payload.get("sub")
        # Check if the username is present in the token payload
        if not username:
            raise HTTPException(status_code=401, detail="Invalid token")
        # Return the username if valid
        return {"username": username}
    # Handle any JWT decoding errors
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

from jose import JWTError

async def get_current_user(token: str = Depends(oauth2_scheme)):
    try:
        # Decode and verify the JWT token
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        # Extract the username from the token payload
        username: str = payload.get("sub")
        # Check if the username is present in the token payload
        if not username:
            raise HTTPException(status_code=401, detail="Invalid token")
        # Return the username if valid
        return {"username": username}
    # Handle any JWT decoding errors
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

Here's a breakdown of what it does:

Decode and Verify the Token:
- Use jwt.decode to decode and verify the token using your SECRET_KEY and ALGORITHM.
- This step extracts the token payload, which includes the user credentials.
Extract and Validate the Username:
- Retrieve the username from the token payload's "sub" (subject) field.
- Check if the username exists; if it's missing, the token is invalid, and you should raise an HTTPException with status code 401.
Handle Decoding Errors:
- Use a try-except block to catch any JWTError. If an error occurs during decoding, raise an HTTPException with status code 401, ensuring the security of your application.

By following these steps, we create a reliable method to verify JWT tokens, ensuring only authenticated users can access secure parts of our API.

Verifying JWT Tokens for Secure Access

Setup from Previous Lesson

Join the 1M+ learners on CodeSignal

Understanding Token Verification

Set Up OAuth2 Scheme

Passing the Scheme to a Function

Verifying the Token

Securing an Endpoint

Accessing the Secured Endpoint

Unauthorized Access

Summary and Last Practices