FastAPI でリクエストの認証と認可を実装する方法

$ pip install fastapi $ pip install uvicorn

from fastapi import FastAPI app = FastAPI() @app.get("/") def read_root(): return {"Hello": "World"}

from fastapi import Depends, FastAPI, HTTPException, status from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

class User: def __init__(self, username: str, password: str, disabled: bool = False): self.username = username self.password = pwd_context.hash(password) self.disabled = disabled def verify_password(self, password: str): return pwd_context.verify(password, self.password) def get_user(self, username: str): if self.username == username: return self

fake_db = [ User(username="user1", password="password"), User(username="user2", password="password", disabled=True) ]

def authenticate_user(username: str, password: str): user = get_user(username) if not user: return False if not user.verify_password(password): return False return user

def get_current_user(token: str = Depends(oauth2_scheme)): credentials_exception = HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"}, ) user = authenticate_user(token) if not user: raise credentials_exception return user

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/token") @app.post("/token") async def login(form_data: OAuth2PasswordRequestForm = Depends()): user = authenticate_user(form_data.username, form_data.password) if not user: raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid username or password", headers={"WWW-Authenticate": "Bearer"}, ) return {"access_token": str(user.username), "token_type": "bearer"} @app.get("/items/") async def read_items(current_user: User = Depends(get_current_user)): return {"items": [{"item_id": "Item 1"}, {"item_id": "Item 2"}]}

$ uvicorn app:app --reload

$ curl --request POST --url http://localhost:8000/token --header 'Content-Type: application/x-www-form-urlencoded' --data 'username=user1&password=password'

{"access_token":"user1","token_type":"bearer"}

$ curl --request GET --url http://localhost:8000/items/ --header 'Authorization: Bearer user1'

{"items":[{"item_id":"Item 1"},{"item_id":"Item 2"}]}