Docs

8. Authentication & Authorisation

8.1 Approach: No AWS — FastAPI-Native JWT

We use FastAPI’s built-in security utilities plus standard Python libraries so there is no dependency on AWS (e.g. no Cognito).

8.2 Recommended Stack

ComponentLibraryPurpose
Password hashingpasslib with bcryptHash passwords before storing; verify on login.
JWT creation/verificationpython-jose[cryptography] or PyJWTIssue access (and optionally refresh) tokens; verify on each request.
FastAPI integrationOAuth2PasswordBearer, Depends()Token extraction and dependency for “current user”.

8.3 Installation (Backend)

pip install "python-jose[cryptography]" passlib[bcrypt] python-multipart
# or: PyJWT instead of python-jose if preferred

8.4 Flow (Summary)

  1. Register: POST /auth/register with email, password, role → hash password → store user → return success (or + tokens).
  2. Login: POST /auth/login (or /token) with email + password → verify password → return access token (and optionally refresh token).
  3. Protected routes: Client sends Authorization: Bearer <access_token>; FastAPI dependency validates JWT and loads user.
  4. Refresh (optional): POST /auth/refresh with refresh token → return new access token.
  5. Password reset: POST /auth/forgot-password → send email with signed link → GET/POST reset page → set new password.

8.5 Security Practices

  • Store only hashed passwords (bcrypt).
  • Access token: short-lived (e.g. 15–60 minutes).
  • Refresh token: longer-lived (e.g. 7 days), stored in DB or allowlist if you want revocation.
  • Use HTTPS only in production.
  • Keep JWT secret in environment variables; never in code.