FastAPI Receives Basic Auth Headers Instead of Bearer

[jda5]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from fastapi import HTTPException, Depends, status, Request
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from jose import jwt, JWTError, ExpiredSignatureError
from starlette.datastructures import Secret

from common.settings import ACCESS_SECRET_KEY, HASHING_ALGORITHM

# Initialization of HTTPBearer for security
security = HTTPBearer()


# Exception for invalid user credentials
INVALID_USER_HTTP_EXCEPTION = HTTPException(
    status_code=status.HTTP_401_UNAUTHORIZED,
    detail="Could not validate credentials.",
    headers={"WWW-Authenticate": "Bearer"},
)

def decode_jwt_token(token: str, secret_key: Secret) -> dict:
    """Decodes a JWT token using the provided secret key.

    This function validates a JWT token's structure and ensures it hasn't expired.
    It distinguishes between tracking tokens and access/refresh tokens, applying
    specific validations for each.

    Args:
        token: The JWT token to be decoded.
        secret_key: The secret key used for decoding the token.

    Returns:
        The decoded token payload as a dictionary.

    Raises:
        HTTPException: For invalid tokens, expired tokens, or tokens with missing fields.
    """
    try:
        payload = jwt.decode(token, key=str(secret_key), algorithms=[HASHING_ALGORITHM])
        token_type = payload.get('token_type')

        if token_type not in ('tracking', 'access', 'refresh'):
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid token type.")

        if token_type == 'tracking' and (not payload.get('contact_id') or not payload.get('sequence_id')):
            raise INVALID_USER_HTTP_EXCEPTION

        if token_type in ('access', 'refresh') and not payload.get("sub"):
            raise INVALID_USER_HTTP_EXCEPTION

        return payload
    except ExpiredSignatureError:
        raise HTTPException(status_code=440, detail="Token has expired. Log-in again.", headers={"WWW-Authenticate": "Bearer"})
    except JWTError as e:
        _logger.info(f"JWTError: {e}")
        raise INVALID_USER_HTTP_EXCEPTION


def verify_access_token(authorization: HTTPAuthorizationCredentials = Depends(security)) -> str:
    """Verifies an access token and retrieves the user's email.

    Decodes the access token from the authorization header to ensure it is valid
    and extracts the user's email address from it.

    Args:
        authorization: The authorization credentials containing the JWT token.

    Returns:
        The user's email address extracted from the token.

    Raises:
        HTTPException: If the token is invalid or if the email is missing.
    """
    token = authorization.credentials
    payload = decode_jwt_token(token=token, secret_key=ACCESS_SECRET_KEY)
    email = payload.get("sub")

    if email is None:
        raise INVALID_USER_HTTP_EXCEPTION

    return email

Description

I'm encountering an intermittent issue with my FastAPI application where the Authorization headers switch from Bearer token to Basic auth without any changes to the request being made. This issue resolves itself without any clear intervention, making it particularly perplexing. The application is containerised using Docker, and I'm testing the endpoints using the auto-docs generated by FastAPI.

Running the above code, I kept receiving a 403 response with the message "Invalid authentication credentials". This is the response that FastAPI automatically returns when the authorization scheme of the request Header is not equal to "bearer".

When sending a GET request to my FastAPI endpoint with a Bearer token in the Authorization header, the application sometimes logs the Authorization header as Basic auth instead. This issue appears randomly and resolves itself after some time. Below are the details of the curl command and the logs from two different attempts:

curl -X 'GET' \
  'http://localhost/users/' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>'

First Attempt Log (Issue Present):

2024-03-26 10:02:56

2024-03-26 10:02:56

Headers: Headers(
{
    "host": "localhost",
    "authorization": "Basic YWRtaW...",
    "sec-fetch-site": "same-origin",
    "accept-language": "en-GB,en;q=0.9",
    "accept-encoding": "gzip, deflate",
    "sec-fetch-mode": "cors",
    "accept": "application/json",
    "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15",
    "connection": "keep-alive",
    "referer": "http://localhost/docs",
    "cookie": "session=eyJzdGF0ZSI6I...",
    "sec-fetch-dest": "empty",
}
)

Second Attempt Log (Issue Resolved, 17 minutes later):

2024-03-26 10:19:12

2024-03-26 10:19:12

Headers: Headers(
{
    "host": "localhost",
    "authorization": "Bearer <token>",
    "sec-fetch-site": "same-origin",
    "accept-language": "en-GB,en;q=0.9",
    "accept-encoding": "gzip, deflate",
    "sec-fetch-mode": "cors",
    "accept": "application/json",
    "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15",
    "connection": "keep-alive",
    "referer": "http://localhost/docs",
    "cookie": "session=eyJzdGF0ZS...",
    "sec-fetch-dest": "empty",
}
)

Attempts to Diagnose/Resolve the Issue:

• Ensured no caching proxies or layers are interfering with the requests.
• Checked Docker container and network configurations for potential misconfigurations.
• Reviewed FastAPI and related dependencies for updates or known issues.

Are there known issues with FastAPI's HTTPBearer class that might cause this intermittent recognition of Bearer vs. Basic auth headers? Can anyone shed some light on how I might go about fixing this issue?

Any insights, experiences, or suggestions would be greatly appreciated. Thank you in advance for your help!

Operating System

macOS

Operating System Details

• Model: MacBook Air, M1 2020
• Chip: Apple M1
• MacOS: Ventura 13.6.4

FastAPI Version

0.109.2

Pydantic Version

2..5.1

Python Version

Python 3.11.8

Additional Context

No response

[YuriiMotov]

Can you share full code example?
It would be great if you can give us code example we can run and see the same result. Or at least code that gets that result when you run it.
Try to minimize code, exclude all unnecessary things.

[YuriiMotov]

Closing this. Feel free to reopen it when you are ready to provide more info