Authentication and Security in Python
🔐 Authentication and Security in Python
Authentication and security are essential for protecting applications and data from unauthorized access, misuse, and attacks. Python offers various tools and libraries to implement robust security measures.
✅ 1. Authentication Basics
Authentication is the process of verifying who a user is.
Common Authentication Methods:
Username and password
Token-based authentication (e.g., JWT)
OAuth 2.0
Multi-Factor Authentication (MFA)
🛠️ 2. Implementing Basic Authentication
🔑 Username & Password (with Hashing)
python
Copy
Edit
import bcrypt
# Hashing a password
password = b"my_secure_password"
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
# Verifying the password
if bcrypt.checkpw(password, hashed):
print("Authentication successful")
else:
print("Authentication failed")
Never store plain-text passwords! Always hash them using libraries like bcrypt or argon2.
🔐 3. Token-Based Authentication with JWT
JWT (JSON Web Tokens) are widely used for stateless authentication.
Example with PyJWT:
python
Copy
Edit
import jwt
import datetime
SECRET_KEY = "mysecretkey"
# Create a token
payload = {"user_id": 123, "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=1)}
token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
# Decode a token
try:
decoded = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
print("Authenticated user:", decoded["user_id"])
except jwt.ExpiredSignatureError:
print("Token has expired")
🔒 4. Web App Authentication (Flask Example)
python
Copy
Edit
from flask import Flask, request, jsonify
import bcrypt
app = Flask(__name__)
users = {"admin": bcrypt.hashpw(b"password123", bcrypt.gensalt())}
@app.route('/login', methods=['POST'])
def login():
data = request.json
username = data.get('username')
password = data.get('password').encode()
if username in users and bcrypt.checkpw(password, users[username]):
return jsonify({"message": "Login successful"})
return jsonify({"message": "Invalid credentials"}), 401
app.run()
🧰 5. Security Best Practices in Python
🔐 Password Handling
Use bcrypt or argon2 for hashing.
Never log passwords.
Enforce strong password policies.
🔑 Secure Secrets Management
Store secrets in environment variables, not in code.
Use python-dotenv, AWS Secrets Manager, or HashiCorp Vault.
🚫 Input Validation
Prevent SQL injection (use ORMs like SQLAlchemy or parameterized queries).
Sanitize user inputs.
Avoid eval() or exec() on user data.
✅ HTTPS & SSL
Always use HTTPS in production.
Use certifi or ssl modules to handle SSL certificates securely.
🧪 6. Useful Python Security Libraries
Purpose Library
Password hashing bcrypt, argon2-cffi
Token auth PyJWT, Authlib
OAuth Flask-Dance, Authlib
Input sanitization bleach, cerberus
Rate limiting Flask-Limiter
Environment security python-dotenv
🧷 7. Testing & Auditing Tools
Bandit: Static code analysis for Python security issues.
bash
Copy
Edit
pip install bandit
bandit -r your_project/
Safety: Checks for known vulnerabilities in packages.
bash
Copy
Edit
pip install safety
safety check
🛡️ Summary
Area Action
Passwords Hash securely using bcrypt or argon2
Tokens Use JWT with expiration + signing keys
Input Handling Validate & sanitize all user input
Secrets Use env vars or secret managers
Libraries Regularly scan and patch vulnerabilities
Learn Full Stack Python Course in Hyderabad
Read More
Building a Data-Driven Web Application with Python
How to Use SQLAlchemy with Flask for Database Management
Introduction to MongoDB for Full Stack Python
Creating and Managing Relationships in Databases with Django ORM
Visit Our Quality Thought Training in Hyderabad
Comments
Post a Comment