Authentication & Security Architecture
Secure production Python backends. Master password hashing (Argon2/bcrypt), JWT access/refresh tokens, OAuth2, RBAC, SQLi/XSS/CSRF mitigations, CORS, rate limiting, and secret management.
Plaintext Passwords & Hardcoded Secrets vs Cryptographic Security
Never store raw credentials or hardcode secrets in source code. Always use salted Argon2id/bcrypt hashes and environment variables.
# ❌ Plaintext password & hardcoded JWT secret!
user.password = "mypassword123"
SECRET_KEY = "12345"
# Vulnerable SQL Injection query
db.execute(f"SELECT * FROM users WHERE id='{user_id}'")# ✅ Salted Argon2id hashing & env settings
user.hashed_pwd = pwd_context.hash(plain_pwd)
SECRET_KEY = settings.SECRET_KEY
# Parameterized ORM query blocks SQLi
select(UserModel).where(UserModel.id == user_id)🛡️ Web Security Vulnerability Defense Matrix
Parameterized queries via SQLAlchemy 2.0 ORM prevent SQL string execution.
HTML output escaping & Content-Security-Policy (CSP) headers block malicious scripts.
Anti-CSRF tokens, SameSite=Strict cookies, and whitelisted CORS origins.
Role-based access dependencies verify permissions before executing route handlers.
💻 Production Blueprint: JWT Password Hashing & RBAC Dependency
Observe how `require_role(["admin"])` validates JWT signature and permission scopes.
from passlib.context import CryptContext
from jose import jwt
from fastapi import Depends, HTTPException, status
pwd_context = CryptContext(schemes=["argon2", "bcrypt"], deprecated="auto")
def require_role(allowed_roles: list[str]):
def role_checker(token: str = Depends(oauth2_scheme)):
payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
if payload.get("role") not in allowed_roles:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
return payload
return role_checker