Authentication with JWT and OAuth 2.0

import time
import jwt                                    # pip install pyjwt
from fastapi import Depends, FastAPI, HTTPException
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from fastapi.testclient import TestClient
 
SECRET = "change-me: load from a secrets manager"   # HS256 shared secret (RS256/ES256 use key pairs)
 
def issue_token(user_id: str, scopes: list[str], ttl_s: int = 900) -> str:
    now = int(time.time())
    return jwt.encode({"sub": user_id, "scope": " ".join(scopes), "iat": now, "exp": now + ttl_s},
                      SECRET, algorithm="HS256")
 
def current_user(creds: HTTPAuthorizationCredentials = Depends(HTTPBearer(auto_error=False))) -> dict:
    if creds is None:
        raise HTTPException(401, "missing token")
    try:
        return jwt.decode(creds.credentials, SECRET, algorithms=["HS256"])   # checks signature AND expiry
    except jwt.ExpiredSignatureError:
        raise HTTPException(401, "token expired")
    except jwt.InvalidTokenError:
        raise HTTPException(401, "invalid token")
 
app = FastAPI()
@app.get("/me")
def me(user: dict = Depends(current_user)):
    return {"user": user["sub"], "scope": user["scope"]}
 
c = TestClient(app)
good = issue_token("alice", ["chat:read", "chat:write"])
expired = issue_token("alice", ["chat:read"], ttl_s=-10)
tampered = good[:-4] + ("AAAA" if not good.endswith("AAAA") else "BBBB")
for name, headers in [("no token", {}), ("valid", {"Authorization": f"Bearer {good}"}),
                      ("expired", {"Authorization": f"Bearer {expired}"}),
                      ("tampered", {"Authorization": f"Bearer {tampered}"})]:
    r = c.get("/me", headers=headers)
    print(f"{name:9} -> {r.status_code} {r.json()}")
print("payload is only base64, not encrypted:", jwt.decode(good, options={"verify_signature": False})["sub"])

no token  -> 401 {'detail': 'missing token'}
valid     -> 200 {'user': 'alice', 'scope': 'chat:read chat:write'}
expired   -> 401 {'detail': 'token expired'}
tampered  -> 401 {'detail': 'invalid token'}
payload is only base64, not encrypted: alice