api-securitylisted

# API Security Patterns ## Authentication ```python # JWT verification — pin algorithm, check expiry import jwt from fastapi import HTTPException, Security from fastapi.security import HTTPBearer security = HTTPBearer() def verify_token(token: str) -> dict: try: payload = jwt.decode( token, settings.JWT_PUBLIC_KEY, algorithms=["RS256"], # Pin algorithm — never accept "none" options={"require": ["exp", "iat", "sub"]}, audience="api.example.com", ) return payload except jwt.ExpiredSignatureError: raise HTTPException(401, "Token expired") except jwt.InvalidTokenError: raise HTTPException(401, "Invalid token") # API Key — hash stored, compared in constant time import hashlib, hmac, secrets def create_api_key() -> tuple[str, str]: raw = secrets.token_urlsafe(32) hashed = hashlib.sha256(raw.encode()).hexdigest() return raw, hashed # return raw once, store hashed def verify_api_key(provided: str, stored_hash: str) -> bool: provided_hash = hashlib.sha256(provided.encode()).hexdigest() return hmac.compare_digest(provided_hash, stored_hash) ``` ## Authorization — BOLA Prevention ```python # Broken Object Level Authorization — always check ownership from fastapi import Depends async def get_invoice( invoice_id: int, current_user: User = Depends(get_current_user), db: AsyncSession = Depends(get_db), ): invoice = await db.