Getting user by cookie programmatically

[hannawagner]

Hello 😃

I know that Fastapi-users/Fastapi has been designed as a Rest-api, but I am still wondering, if it is possible to get the currently logged in user programmatically via cookies?

What I'm currently doing, which I don't like that much, is sending a python request to call my app to get to the result via:
requests.get('https://localhost:8001/users/me', cookies=cookies)

I also tried including the current_user dependency in the fastapi route directly. The problem here is that I want to access the result in the @security_checks decorator which did not work out:

current_user = fastapi_users.current_user()

@app.get("/protected-route")
@security_checks
def protected_route(request: Request, user: User = Depends(current_user)):
      return f"Hello, {user.email}"

Can anybody help me please (or tell me that it is impossible and I should stop trying)? 😄

[frankie567]

Hi @hannawagner!

I don't really get what you're trying to do. The purpose of current_user is exactly to get the current logged in user (via a cookie or whatever) in your own route.

I'm not aware of the security_checks decorator. Could you give more details about it? Where does it come from?

[hannawagner]

Thank you for the quick reply!

The security_checks decorator is a custom function, checking some authentication/access logic for my web app.
Here are the relevant pieces of it:

def security_checks (func):
    """Decorate if user is authorized."""

    @wraps(func)
    def debug_wrapper(request, **kwargs):
        [...]
        return func(request, **kwargs)

    @wraps(func)
    def wrapper(request, **kwargs):
        cookies = request.cookies.get('fastapiusersauth')
        if not cookies:
            raise HTTPException(status_code=401, detail="Unauthorized")
        user = get_user_by_cookie(cookies, address="http://127.0.0.1:8001")
        [...]

        return func(request, **kwargs)

    if settings.app["login_required"] is True:
        return wrapper
    return debug_wrapper

@lru_cache()
def get_user_by_cookie(cookies: str, host_address: str):
    """
    Get all user info from cookies.

    Parameters
    ----------
    cookies : str
        Complex cookie str
    host_address : str
        Host address of request

    Returns
    -------
    user : dict
    """
    cookies = {"fastapiusersauth": cookies}

    user_result = requests.get(f'{host_address}/users/me', cookies=cookies,
                               verify=False)
    try:
        user= user_result.json()
    except Exception as e:
        print(f"User not active {e}")
        raise HTTPException(status_code=401, detail="Unauthorized")

    return user

Is there a way that I can access the user result directly in my decorator via the request parameter or somehow else?

I hope it is a bit clearer now, let me know if I can provide you with any other info or code 🙏

[frankie567]

Hmm, okay, I better understand your intent now. I think a decorator is not the best way to go here, and it'll block you in the future.

• In FastAPI, decorators are generally not the way to go. While it's the common way to do this kind of things in Flask, the dependency injection of FastAPI is much more convenient here. That's why current_user is a dependency and I'll show you after how you can wrap it with our own logic.
• As you already felt, making a request to your own server to retrieve the current user is not a good way to do this. Basically, you mimic the current_user logic by doing an HTTP request.

So, I would suggest to drop the decorator and implement your security check as a dependency. The good thing about dependencies in FastAPI is that they can be recursive: a dependency can ask for other dependencies and FastAPI magically resolves them all.

In your case, security_checks could be a dependency that's dependent itself of current_user. I understand that the purpose of security_checks is to be able to disable the authentication given a global setting. For this, we'll leverage the optional flag of current_user to prevent it from raising an error automatically.

For example:

current_active_user = fastapi_users.current_user(active=True, optional=True)

async def security_checks(user: Optional[User] = Depends(current_active_user)):
    if settings.app["login_required"]:
        if user is None:  # With the optional flag, user can be None
            raise HTTPException(status_code=401)  # No user, and login is required -> raise a 401 error
        return user
    
    # Do what you need here... Return a dummy user?
    return User(...)

And then in your route, you can use it as a dependency:

@app.get("/protected-route")
def protected_route(request: Request, user: User = Depends(security_checks)):
      return f"Hello, {user.email}"

Hope that it'll give you good ideas about how to implement what you need :)

[hannawagner]

Thanks a lot! This gives me some a good idea/start how to restructure my app without making the HTTP requests 👍