🛠 Native JWT support

[k4black]

Relevance

About half of the modern internet uses raw JWT (the other half uses OAuth2, which is already supported).
I think that in such a modern library as fastapi, native support of JWT will be a big advantage.

Existed solutions

Only 1 external lib: github:fastapi-jwt-auth (192 stars) - an flask-jwt-auth customization.

The following drawbacks are significant:

1. poorly supported (last updated in 2020)
2. depends on the original library
3. DOES NOT match the fastapi security style (Security/Depends function args wrapper)
4. no openapi specification generation

Existed Issues and Pull Requests:

• Searching 'jwt' or 'json web tokens' - 'No results matched' (except docs example)

---

Features

• bearer/cookie token place
• access/refresh tokens
• time expiring tokens
• auto_error=False support
• openapi specification generation
• fresh token demand
• token revocation
• cookies name selecting
• docs examples (after approval)

Requrements

python-jose for tokens interaction and pytest-mock for testing time-dependent functions.

Usage example

All available use cases can be found in the test files. The simplest example is provided below:

app = FastAPI()

access_security = JwtAccessBearer(secret_key="secret_key")

@app.post("/auth")
def auth():
    subject = {"username": "username", "role": "user"}
    access_token = access_security.create_access_token(subject=subject)
    return {"access_token": access_token, "refresh_token": None}

@app.get("/users/me")
def read_current_user(credentials: JwtAuthorizationCredentials = Security(access_security)):
    return {"username": credentials["username"], "role": credentials["role"]}

---

Any suggestions for improvement are gladly discussed!

[acutaia]

@k4black in security docs @tiangolo in the past used Pyjwt but later he moved to python-jose PR [#1610] so I think we should consider using python-jose for your pull request 🤔

[k4black]

@acutaia
I saw this warning in docs, however, there were no arguments in favour of a younger library. Initially I used python-jose 😃, but migrate to PyJWT, as the most popular library according to jwt.io :libraries:python.
Although I agree that to comply with the general style, there may be a need to rewrite it with python-jose. I'll work on it

[k4black]

@tiangolo Can you approve or decline this PR, please

[jakemanger]

Is this going to be approved or has this just been ignored? Seems like a nice, easy way to add authentication with the option of refresh tokens to me.

[cikay]

Do not reverse the condition add the raise keyword to the if block.

[cikay]

This is where you should reverse the condition the success case should be at the bottom. It is called early return or fast fail.

[JanBeelte]

Is there any chance that this PR or comparable functionality will be merged soon?
What are the next steps here @tiangolo @cikay @k4black @acutaia , I might be willing to take over some work.
Would be very handy to have jwt support out of the box!

[and-sm]

@tiangolo, any update?

[jpmckinney]

python-jose is unmaintained. Please do not use it.

[nsteinmetz]

python-jose is unmaintained. Please do not use it.

latest version of fastapi-jwt allows to use authlib instead of python-jose (still present as fallback)

[Pandede]

Any update?