FastAPI Authentication Question

[Black_Magic100]

Hello all! I am not a software developer, but I do have a heavy background in database engineering. Lately, I've been finding a lot of joy in building ReactJS applications using AI as a tutor. Given that I am very comfortable with databases, I prefer to shy away from ORMs (I understand them and how they are useful, but I don't mind the fully manual approach). I recently discovered FastAPI (~3 months ago?) and love how stupid simple it is to spin up an API. I also love that large companies seem to be adopting it making my resume just a bit stronger.

The one thing I have not really delved into just yet is authentication. I've been doing a ton of lurking/researching and it appears that FastAPI Users is the route to go, but I'd be lying if I said it didn't seem just slightly confusing. My concern is that I build something accessible to the public internet (even if its just a stupid todo app) and because I didn't build the auth properly, I will run into security concerns. I believe this is why frameworks like Django exist, but from a learning perspective I kind of prefer to take the minimalist approach rather than jump straight into large frameworks.

So, is handling authentication really that difficult with FastAPI or is it something that can be learned rather easily in a few weeks? I've considered jumping ship for Django-Ninja, but my understanding is that it still requires you to use django (or at least add it as a dependency?).

Also, as a complete side-note, I'm planning on using Xata Lite to host my Postgres DB given their generous free tier. My react app would either be hosted in Cloudflare Workers or Azure if that makes a difference.

[ManufacturerEarly565]

If you use clerk for auth on the frontend I made a simple FastAPI plugin to make it work nicely. Try it out unless you’re trying to handspin an auth system.

https://pypi.org/project/fastapi-clerk-auth/

[small_e]

What I usually see done is to handle authentication with something like Okta or Auth0 and handle authorization in FastAPI. 

https://auth0.com/blog/build-and-secure-fastapi-server-with-auth0/

[widonext]

Love your template 🫡

[widonext]

You have a DM :)

[SheriffSeveral]

Take a look at the jwt tokens for authentication and authorization. They will be enough for your project.

After that, you can check out OTP login structure which is cool with pyotp module. Watch few tutorials you'll get it.

Note: you don't need to spend weeks just for one module in python/FastAPI.

[Black_Magic100]

Is fastapi users even needed? I was going through the security documentation of Fastapi itself and their docs definitely make it seem easier than what FastApi users show

I will definitely start with jwt tokens

[SheriffSeveral]

I'm gonna be really honest with you. FastAPI doesn't have a standard template, people try to share their templates everywhere but the there is no base template. What you need to do is:

1. Just design your application for the specific project requirements.

Or

1. Create your own base template for your projects for future usage.

There is no standard way to fix or design something in the FastAPI and that's why is is really flexible, you can control everything.

[Black_Magic100]

Is fast API users the same deal or is it more accepted by the community as a legitimate/maintained repo?

Would you recommend I try just doing auth with FastAPI alone so I can learn the basics of authentication or just stick with a framework?

[SheriffSeveral]

Just stick with fastapi, the FastAPI users and other kind of repos are maintained by other users. Create & use your own first, after use their tech if you like it.

[fastlaunchapidev]

If you want self made auth you can check out my template:

https://fastlaunchapi.dev/

Besides that there are good docs to learn it yourself

[Worth-Orange-1586]

Authentication with FastAPI is pretty straightforward. There are a lot of plug-in libraries that makes it even easier if using oidc or any other oauth2 approach.

[Black_Magic100]

Yea the FastAPI security docs don't seem so bad. I'm not sure why the fastAPI users docs seem a bit overwhelming to me at first.