Skip to content

FastAPI Production API v1.2.0 - Authentication Lifecycle

Latest
Latest

Choose a tag to compare

View all tags
@HoungDev HoungDev released this 09 Aug 09:00
· 2 commits to main since this release
v1.2.0
3845177
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

v1.2.0 adds a complete, backward-compatible authentication lifecycle to the
production FastAPI foundation.

Email identity and account recovery

  • Optional normalized email identity during registration
  • Scoped, expiring, single-use verification and password-reset tokens
  • Hash-only lifecycle-token storage and enumeration-resistant request responses
  • Atomic password reset with refresh-session revocation

Sessions and devices

  • Refresh-token families with rotation-replay detection
  • Bounded device labels and authenticated session listing
  • Idempotent per-device and all-session revocation

TOTP multi-factor authentication

  • Encrypted TOTP seeds and replay-resistant counter tracking
  • Opaque second-factor login challenges
  • Hash-only, single-use recovery codes
  • Authentication-method and authentication-time claims for step-up checks

TOTP helps reduce password-only risk but is not phishing resistant. Applications
with that requirement should prefer WebAuthn/passkeys in a future integration.

OpenID Connect

  • Provider-neutral Authorization Code flow with PKCE S256
  • Browser-bound, hash-only state and nonce transactions
  • Strict issuer, audience, authorized-party, signature, and nonce validation
  • Immutable issuer/subject identities and explicit recent-auth account linking
  • No automatic linking of an existing local account by matching email

OIDC deployments still require provider registration, exact redirect URI
configuration, secure credentials, and application-specific threat-model review.

Upgrade notes

  1. Back up the database and configuration.
  2. Review the new email, MFA encryption, and OIDC environment settings.
  3. Install v1.2.0 dependencies using the committed lock file.
  4. Run alembic upgrade head to apply the authentication lifecycle migrations.
  5. Validate email delivery, session revocation, MFA, and OIDC behavior in a
    staging environment before production rollout.

The release remains backward compatible for existing local username/password
accounts. New lifecycle capabilities are opt-in through configuration and API use.

Verification

Release artifacts include the source distribution, wheel, and SHA256SUMS.txt.
The final release commit is required to pass linting, formatting, migrations,
the full test and coverage gate, dependency audit, package build, and isolated
wheel smoke test.

Full changelog: v1.1.0...v1.2.0

Assets 5
Loading