Auth Error when i Authenticate > Logout > Authenticate with SwaggerUI

[Jilvo]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from fastapi import FastAPI, status, Request

app = FastAPI(
    exception_handlers={RequestValidationError: validation_exception_handler},
    responses={
        400: {"description": "Functionnal Error", "model": ErrorResponse},
        422: {"description": "Field Validation Error", "model": ErrorResponse},
    },
)


@router.get(
    "/users/me",
    response_model=UserInfo,
    response_model_exclude_none=True,
    response_model_by_alias=False,
)
async def read_users_me(
    request: Request,
    current_user: UserInfo = Depends(di["msal_auth"].scheme),
) -> UserInfo:
  return JSONResponse(
            content=json_compatible_item_data,
            status_code=status.HTTP_200_OK,
        )

Description

Hello everyone,

When I log in using the Authorization Form, it works perfectly. If I wait until the token's expiration date, I just need to log out and then authorize again to get a new token.

BUT if i Authenticate > Logout > Authenticate in less than a minute, I receive a 500 Internal Server Error.

I have two questions:

• Why can't I get a new token?
• What do I need to do in order to obtain a new token in this case? I don't want to reload my browser page.

My app works in an Azure Cloud environment. My token is an OAuth2 configuration.
Thanks in advance for your help
Jilvo

Operating System

Linux, Windows

Operating System Details

No response

FastAPI Version

0.95.0

Pydantic Version

1.10.7

Python Version

Python 3.10.9

Additional Context

No response

[jgould22]

First step is to check the logs on your application, what does it log when you get a 500?

[rmwesley]

Sorry for the delay. I reproduced this auth bug on the Swagger UI (/docs endpoint) of our API.
Here are the logs it generated:

API functional logs

2023-11-27T08:47:25.453147928Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /docs HTTP/1.1" 200 OK
2023-11-27T08:47:33.524642395Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /_login_route?response_type=code&client_id=&redirect_uri=https%3A%2F%2Fdomain.name%2Fdocs%2Foauth2-redirect&state=LOCALTIME+ENCODED+IN+BASE64 HTTP/1.1" 307 Temporary Redirect
2023-11-27T08:47:25.637428785Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /openapi.json HTTP/1.1" 200 OK
2023-11-27T08:47:33.487911682Z: [ERROR]  WARN : 2023-11-27 08:47:33,485 - Region configured (None) != region detected ('xyz')
2023-11-27T08:47:33.683699218Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /docs/oauth2-redirect?code=quite.long.code&client_info=JSON+IN+BASE64&state=LOCALTIME+ENCODED+IN+BASE64&session_state=some-hyphen-separated-alphanumerical-strings HTTP/1.1" 200 OK
2023-11-27T08:47:34.038033585Z: [ERROR]  WARN : 2023-11-27 08:47:34,037 - Region configured (None) != region detected ('xyz')
2023-11-27T08:47:34.263056814Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "POST /token HTTP/1.1" 200 OK
2023-11-27T08:47:37.755071253Z: [ERROR]  WARN : 2023-11-27 08:47:37,754 - Region configured (None) != region detected ('xyz')
2023-11-27T08:47:37.763516059Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /_login_route?response_type=code&client_id=&redirect_uri=https%3A%2F%2Fdomain.name%2Fdocs%2Foauth2-redirect&state=LOCALTIME+ENCODED+IN+BASE64 HTTP/1.1" 307 Temporary Redirect
2023-11-27T08:47:37.981582539Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "GET /docs/oauth2-redirect?code=very.long.code&client_info=JSON+IN+BASE64&state=LOCALTIME+IN+NON+PADDED+BASE64&session_state=some-hyphen-separated-alphanumerical-strings HTTP/1.1" 200 OK
2023-11-27T08:47:38.330383170Z: [ERROR]  WARN : 2023-11-27 08:47:38,329 - Region configured (None) != region detected ('xyz')
2023-11-27T08:47:38.438954165Z: [INFO]  INFO:     1XX.XXX.XXX.1:XXXXX - "POST /token HTTP/1.1" 500 Internal Server Error
2023-11-27T08:47:38.506039721Z: [ERROR]  ERROR:    Exception in ASGI application
2023-11-27T08:47:38.506112920Z: [ERROR]  Traceback (most recent call last):
2023-11-27T08:47:38.506119320Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/uvicorn/protocols/http/httptools_impl.py", line 419, in run_asgi
2023-11-27T08:47:38.506123920Z: [ERROR]      result = await app(  # type: ignore[func-returns-value]
2023-11-27T08:47:38.506127920Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/uvicorn/middleware/proxy_headers.py", line 78, in __call__
2023-11-27T08:47:38.506133720Z: [ERROR]      return await self.app(scope, receive, send)
2023-11-27T08:47:38.506137620Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi/applications.py", line 276, in __call__
2023-11-27T08:47:38.506149620Z: [ERROR]      await super().__call__(scope, receive, send)
2023-11-27T08:47:38.506154320Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/applications.py", line 122, in __call__
2023-11-27T08:47:38.506158620Z: [ERROR]      await self.middleware_stack(scope, receive, send)
2023-11-27T08:47:38.506162520Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/middleware/errors.py", line 184, in __call__
2023-11-27T08:47:38.506166720Z: [ERROR]      raise exc
2023-11-27T08:47:38.506180720Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/middleware/errors.py", line 162, in __call__
2023-11-27T08:47:38.506185020Z: [ERROR]      await self.app(scope, receive, _send)
2023-11-27T08:47:38.506188920Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/middleware/sessions.py", line 86, in __call__
2023-11-27T08:47:38.506192720Z: [ERROR]      await self.app(scope, receive, send_wrapper)
2023-11-27T08:47:38.506196519Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/asgi_correlation_id/middleware.py", line 90, in __call__
2023-11-27T08:47:38.506200419Z: [ERROR]      await self.app(scope, receive, handle_outgoing_request)
2023-11-27T08:47:38.506204119Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/middleware/exceptions.py", line 79, in __call__
2023-11-27T08:47:38.506208019Z: [ERROR]      raise exc
2023-11-27T08:47:38.506211619Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/middleware/exceptions.py", line 68, in __call__
2023-11-27T08:47:38.506215519Z: [ERROR]      await self.app(scope, receive, sender)
2023-11-27T08:47:38.506219219Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi/middleware/asyncexitstack.py", line 21, in __call__
2023-11-27T08:47:38.506223019Z: [ERROR]      raise e
2023-11-27T08:47:38.506226719Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi/middleware/asyncexitstack.py", line 18, in __call__
2023-11-27T08:47:38.506230619Z: [ERROR]      await self.app(scope, receive, send)
2023-11-27T08:47:38.506234619Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/routing.py", line 718, in __call__
2023-11-27T08:47:38.506238519Z: [ERROR]      await route.handle(scope, receive, send)
2023-11-27T08:47:38.506242319Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/routing.py", line 276, in handle
2023-11-27T08:47:38.506248119Z: [ERROR]      await self.app(scope, receive, send)
2023-11-27T08:47:38.506251919Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/starlette/routing.py", line 66, in app
2023-11-27T08:47:38.506255719Z: [ERROR]      response = await func(request)
2023-11-27T08:47:38.506259319Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi/routing.py", line 237, in app
2023-11-27T08:47:38.506263219Z: [ERROR]      raw_response = await run_endpoint_function(
2023-11-27T08:47:38.506266919Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi/routing.py", line 163, in run_endpoint_function
2023-11-27T08:47:38.506270819Z: [ERROR]      return await dependant.call(**values)
2023-11-27T08:47:38.506274519Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi_msal/auth.py", line 83, in _post_token_route
2023-11-27T08:47:38.506278419Z: [ERROR]      token: AuthToken = await self.handler.authorize_access_token(
2023-11-27T08:47:38.506282319Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi_msal/security/msal_auth_code_handler.py", line 51, in authorize_access_token
2023-11-27T08:47:38.506286418Z: [ERROR]      auth_token: AuthToken = await self.msal_app(cache=cache).finalize_auth_flow(
2023-11-27T08:47:38.506290118Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi_msal/clients/async_conf_client.py", line 106, in finalize_auth_flow
2023-11-27T08:47:38.506297918Z: [ERROR]      return AuthToken.parse_obj_debug(to_parse=auth_token)
2023-11-27T08:47:38.506301818Z: [ERROR]    File "/usr/local/lib/python3.10/site-packages/fastapi_msal/models/base_auth_model.py", line 13, in parse_obj_debug
2023-11-27T08:47:38.506305818Z: [ERROR]      debug_model: AuthModel = cls.parse_obj(obj=to_parse)
2023-11-27T08:47:38.506309618Z: [ERROR]    File "pydantic/main.py", line 526, in pydantic.main.BaseModel.parse_obj
2023-11-27T08:47:38.506313518Z: [ERROR]    File "pydantic/main.py", line 341, in pydantic.main.BaseModel.__init__
2023-11-27T08:47:38.506317418Z: [ERROR]  pydantic.error_wrappers.ValidationError: 1 validation error for AuthToken
2023-11-27T08:47:38.506321218Z: [ERROR]  id_token
2023-11-27T08:47:38.506324818Z: [ERROR]    field required (type=value_error.missing)

Description

When we do Authorize > Logout > Authorize on the Swagger UI we get a "Auth error 500" response instead of a 400 for Bad Request (in the case of inavalid credentials in request body) or a 401 for Unauthorized.

[rmwesley]

Which of the packages in the "authentication chain" has the responsibility of raising HTTP errors ? To the controller, route or whatever. So that the client gets a 400 or 401 response instead of a 500 for an unhandled internal error.

I believe these Runtime Errors need to simply be wrapped up in a try/catch block and an HTTP error should be raised instead.
Raising HTTP errors is the responsibility of https://github.com/dudil/fastapi_msal/, by any chance?

They do raise HTTP errors for authentication in https://github.com/dudil/fastapi_msal, so it seems to be their responsibility in the "auth chain", no?

They have this Issue:
dudil/fastapi_msal#15

And this PR with a fix by yaokaibb that was sadly closed, not merged :
dudil/fastapi_msal#21

Me and yaokaibb think alike lol.

[YuriiMotov]

Let's close this for now to keep the discussions clean and organized.
If you’ve found a solution, please share it here.
If you still need help, feel free to let us know.