-
Notifications
You must be signed in to change notification settings - Fork 64
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Question] How to actually authenticate user #41
Comments
Hi! I'm writing this on my phone, so let me know if anything is unclear and I'll write it a bit more extensive when I'm at a PC.
Glad to hear you find it easy to set up and you got it working!
What I write below is better explained here. It will depend on your solution, but most likely not. This package only implement token authentication through so-called This works well for Single-Page applications (SPA), where the frontend is separated from the backend and dynamic content is rendered through JavaScript. Retrieving of the token is done solely by the frontend (using a flow known as the PKCE flow). The frontend then attach the token in the header on every API request sent to the backend. The backend does not care how the user retrieves the token, it only validates it. In most MVC/full web applications the backend render HTML content based on variables (such as in Jinja2 you'd write When the user is authenticated and the access token is retrieved (by the backend), the state will be kept by using sessions. The access token is no longer used (until the session expires or the user logs out and want to log in again). This package does not support that flow, nor uses sessions. The only real way to use this package for you is to:
I have not attempted this my self. There is another package called Lastly, I just want to be clear and say that I will not implement the Authorization Code Flow and sessions for MVC applications. I'm going to close this issue, but please feel free to ask more questions. I'll still be notified 😊 |
Wow, thank you so much for that incredibly detailed and HELPFUL answer! I will take a look at the two links and the library you mention. I will absolutely keep using this package for api-only apps but I went ahead and dug into the msal library for microsoft authentication on the mvc apps. Again, thank you very much. |
You're welcome! Let me know if you haven't found a solution that works for you by New Years and I'll give it a go. 😊 |
This library was easy to set up and works great when I access the /docs link and manually click authenticate. However, I'm using FastAPI as a full web app framework with jinja2 templating pages - not just api calls. Can I use this library for authentication? The security is working because after implementation, my pages are inaccessible and I get "not authenticated" message. However, how do I actually route a user to the microsoft login page to authenticate and then bring them back to the page I want? Have any examples of this?
The text was updated successfully, but these errors were encountered: