FastAPI v1.2.0 Introduces Full Authentication Lifecycle Beyond Basic JWT Login

·1 views

A developer building FastAPI Production API v1.2.0 has documented the design decisions behind a comprehensive authentication system that goes well beyond standard tutorial-level login flows. The implementation introduces scoped, single-use, hashed account-action tokens for email verification and password reset, ensuring neither can be replayed or misused across operations. Password resets now atomically revoke all active refresh-token sessions, while a token-family model groups rotated refresh tokens to support per-device session listing and revocation. Multi-factor authentication is handled through a two-step TOTP enrollment process with encrypted seed storage, alongside hashed recovery codes and replay protection via counter tracking. The release also incorporates OIDC login using the Authorization Code flow with PKCE, addressing common pitfalls such as unsafe email-based identity linking.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How HTTP Request Smuggling Works and How to Defend Against It

HTTP Request Smuggling is a web attack that exploits inconsistencies in how front-end proxies and back-end servers parse HTTP/1.1 requests, particularly when both Content-Length and Transfer-Encoding headers are present. Attackers can craft malformed requests that cause one server to treat leftover data as a new, separate request, effectively bypassing security controls. The technique enables serious harms including WAF bypass, cache poisoning, session hijacking, and credential theft. Mitigations include adopting HTTP/2 end-to-end, rejecting requests with conflicting length headers, and normalizing requests at the proxy layer. Application-level defenses such as strict HTTP parsing, connection timeouts, and anomaly monitoring further reduce the attack surface.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Zero-Cost Ecommerce MVP Using Next.js, Vercel, and Supabase

A developer built a lightweight ecommerce MVP for a founder who needed a simple way to display products and collect orders via WhatsApp, without online payments or a Shopify subscription. The solution was built using Next.js for the frontend and admin panel, with Supabase handling product data storage and Vercel hosting the application — all on free tiers, bringing monthly infrastructure costs to zero. The MVP covers only three core steps: browsing products, adding them to a cart, and sending the order directly to WhatsApp. Features like authentication, payment gateways, and email notifications were deliberately excluded, as they were not required to validate the business idea. The developer noted that added complexity such as online payments and order tracking can be introduced later, once the business gains real traction and justifies the need.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 1-to-Many Transaction Matching Is a Hard Engineering Problem

Exact transaction matching assumes a one-to-one relationship between bank and ledger records, but real-world reconciliation often involves a single bank transaction that corresponds to multiple ledger entries. A basic row-to-row matcher will flag these as failures even when the ledger amounts correctly sum to the bank total. The core challenge shifts from simple equality checks to identifying valid combinations of ledger rows that explain a given bank transaction. Candidate selection becomes computationally complex at scale, as testing every possible combination across thousands of records risks both high processing costs and false positives. Reconciliation systems that handle only one-to-one matching will push legitimate transactions into manual review, making one-to-many logic a critical engineering requirement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Browser Turns a URL Into a Webpage: A Step-by-Step Breakdown

When a user types a URL into a browser and hits Enter, a multi-step process begins before any webpage appears on screen. The browser first uses DNS to translate the human-readable domain name into a numerical IP address needed for network routing. It then establishes a network connection with the destination server, securing it via TLS encryption when the URL uses HTTPS. The browser sends an HTTP request to the server, which responds with HTML, CSS, and JavaScript files. Finally, the browser parses and renders those files to display the completed webpage to the user.

0 comments Read more at DEV Community