Why authentication not work when i change object value?

[Ar-Anik]

First Check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from datetime import datetime, timedelta

from fastapi import Depends, FastAPI, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from jose import JWTError, jwt
from passlib.context import CryptContext
from pydantic import BaseModel

# to get a string like this run:
# openssl rand -hex 32
SECRET_KEY = "a50e71f6776a2977dfaf763b8d3987add1435735a07eaae1af50768c0be5dc0e"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30


fake_users_db = {
    "johndoe": {
        "username": "johndoe",
        "full_name": "John Doe",
        "email": "johndoe@example.com",
        "hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
        "disabled": False,
    }
}


class Token(BaseModel):
    access_token: str
    token_type: str


class TokenData(BaseModel):
    username: str = None


class User(BaseModel):
    username: str
    email: str = None
    full_name: str = None
    disabled: bool = None


class UserInDB(User):
    hashed_password: str


pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

app = FastAPI()


def verify_password(plain_password, hashed_password):
    return pwd_context.verify(plain_password, hashed_password)


def get_password_hash(password):
    return pwd_context.hash(password)


def get_user(db, username: str):
    if username in db:
        user_dict = db[username]
        return UserInDB(**user_dict)


def authenticate_user(fake_db, username: str, password: str):
    user = get_user(fake_db, username)
    if not user:
        return False
    if not verify_password(password, user.hashed_password):
        return False
    return user


def create_access_token(data: dict, expires_delta: timedelta = None):
    to_encode = data.copy()
    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(minutes=15)
    to_encode.update({"exp": expire})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt


async def get_current_user(token: str = Depends(oauth2_scheme)):
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        username: str = payload.get("sub")
        if username is None:
            raise credentials_exception
        token_data = TokenData(username=username)
    except JWTError:
        raise credentials_exception
    user = get_user(fake_users_db, username=token_data.username)
    if user is None:
        raise credentials_exception
    return user


async def get_current_active_user(current_user: User = Depends(get_current_user)):
    if current_user.disabled:
        raise HTTPException(status_code=400, detail="Inactive user")
    return current_user


@app.post("/token", response_model=Token)
async def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):
    user = authenticate_user(fake_users_db, form_data.username, form_data.password)
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
            headers={"WWW-Authenticate": "Bearer"},
        )
    access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    access_token = create_access_token(
        data={"sub": user.username}, expires_delta=access_token_expires
    )
    return {"access_token": access_token, "token_type": "bearer"}


@app.get("/users/me/", response_model=User)
async def read_users_me(current_user: User = Depends(get_current_active_user)):
    return current_user


@app.get("/users/me/items/")
async def read_own_items(current_user: User = Depends(get_current_active_user)):
    return [{"item_id": "Foo", "owner": current_user.username}]

if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("9000")))

Description

when i change data from :
"johndoe": {
"username": "johndoe",
"full_name": "John Doe",
"email": "johndoe@example.com",
"hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
"disabled": False,
}

to :

"anik": {
"username": "aranik",
"full_name": "Aubdur Rob Anik",
"email": "anik@gmail.com",
"hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
"disabled": False,
}

for login give username and password, authentication not work and when i hit get url it show Could Not Validate Credentials.
i found SECRET_KEY by openssl rand -hex 32 command.

i found hashed_password by below command:

from passlib.context import CryptContext
pwd_context=CryptContext(schemes=["bcrypt"], deprecated="auto")
pwd_context.hash('password1234')
'$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m'

my password is password1234

Wanted Solution

i want any object or database change authentication work perfectly.

Wanted Code

fake_users_db = {
     "anik": {
         "username": "aranik",
         "full_name": "Aubdur Rob Anik",
         "email": "anik@gmail.com",
         "hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
         "disabled": False,
     }
}

Alternatives

No response

Operating System

Linux

Operating System Details

Linux Mint 21.1

FastAPI Version

0.88.0

Python Version

3.8.10

Additional Context

No response

[ebottos94]

Hi @Ar-Anik in function :

def get_user(db, username: str):
    if username in db:
        user_dict = db[username]
        return UserInDB(**user_dict)

is checked if in fake db there is the key username,

and in "/token" route is created token releted to fake_users_db[your username]["username"] :

access_token = create_access_token(
        data={"sub": user.username}, expires_delta=access_token_expires
    )

So as the docs authentication example is implemented, you must declare fake db key related to user with the same username string.

So your "fake_users_db" :

fake_users_db = {
     "anik": {
         "username": "aranik",
         "full_name": "Aubdur Rob Anik",
         "email": "anik@gmail.com",
         "hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
         "disabled": False,
     }
}

is wrong. Change it with :

fake_users_db = {
     "aranik": {
         "username": "aranik",
         "full_name": "Aubdur Rob Anik",
         "email": "anik@gmail.com",
         "hashed_password": "$2b$12$o2x7llwZjI4dxRIuVHMllevATlnyX8F/n21/6QmoyChEziK8oXq6m",
         "disabled": False,
     }
}

[ebottos94]

@Ar-Anik If your problem is solved can you close the issue? Thank you.