AXV

Autentifikatsiya, avtorizatsiya va JWT

identifikatsiya, autentifikatsiya, avtorizatsiya, session, token, JWT, bcrypt, OAuth2PasswordBearer

10-sinfAdvanced Python Back-end5-hafta · 13-dars

Bugun nimalarni o'rganamiz?

Uch tushuncha

Kim? Isbot? Ruxsat?

Parol va User

bcrypt va register

Login va himoya

JWT, Bearer, Depends

Takrorlash

12-darsda baza sessiyasi qaysi funksiya orqali beriladi?

get_db har so'rov uchun AsyncSession beradi (Depends(get_db)).
01

Uch tushuncha

Kim? Isbot? Ruxsat?

Kirish oqimi

Identifikatsiya:email Autentifikatsiya:parol Token beriladi Avtorizatsiya:rol Har bosqich alohida savolga javob beradi

JWT tuzilishi


# JWT = header.payload.signature (base64url)
# header:    {"alg": "HS256", "typ": "JWT"}
# payload:   {"sub": "user-id", "exp": 1735000000}
# signature: HMAC(header.payload, SECRET_KEY)

from jose import jwt
token = jwt.encode({"sub": "42"}, "SECRET", algorithm="HS256")
data = jwt.decode(token, "SECRET", algorithms=["HS256"])
payload ni har kim o'qiy oladi (base64), lekin kalitsiz o'zgartira olmaydi: imzo buzilib qoladi. Shuning uchun maxfiy ma'lumotni payload ga yozmang.

Mini-test

JWT ning qaysi qismi o'zgartirilmaganini kafolatlaydi?

Imzo kalit bilan hisoblanadi; ma'lumot o'zgarsa imzo mos kelmaydi.
02

Parol va User

bcrypt va register

Register oqimi

POST/auth/register Email bandmi? hash_password Bazagayozish (201) Parol hech qachon ochiq saqlanmaydi

Xeshlash va register


from passlib.context import CryptContext
pwd = CryptContext(schemes=["bcrypt"], deprecated="auto")

def hash_password(p: str) -> str:
    return pwd.hash(p)

def verify_password(p: str, h: str) -> bool:
    return pwd.verify(p, h)

@router.post("/register", response_model=UserRead, status_code=201)
async def register(data: UserCreate, db: AsyncSession = Depends(get_db)):
    if await db.scalar(select(User).where(User.email == data.email)):
        raise HTTPException(409, "Email band")
    user = User(full_name=data.full_name, email=data.email,
                hashed_password=hash_password(data.password))
    db.add(user); await db.commit(); await db.refresh(user)
    return user
Xesh har safar boshqacha chiqadi (tuz, salt): bir xil parol uchun ikki xil xesh. Shuning uchun == emas, faqat verify_password ishlatiladi.

Mini-test

Parol bazada qanday saqlanadi?

Faqat hashed_password saqlanadi.
03

Login va himoya

JWT, Bearer, Depends

Himoyalangan so'rov

POST/auth/login JWT olinadi Authorization:Bearer get_current_user Token yo'q yoki yaroqsiz: 401

Token va get_current_user


oauth2 = OAuth2PasswordBearer(tokenUrl="/auth/login")

def create_access_token(user_id: str) -> str:
    exp = datetime.now(timezone.utc) + timedelta(minutes=60)
    return jwt.encode({"sub": user_id, "exp": exp},
                      settings.jwt_secret_key, algorithm="HS256")

async def get_current_user(token: str = Depends(oauth2),
                           db: AsyncSession = Depends(get_db)) -> User:
    try:
        payload = jwt.decode(token, settings.jwt_secret_key, algorithms=["HS256"])
        user = await db.get(User, uuid.UUID(payload["sub"]))
    except (JWTError, KeyError, ValueError):
        raise HTTPException(401, "Token yaroqsiz")
    if user is None:
        raise HTTPException(401, "Foydalanuvchi topilmadi")
    return user

@router.get("/me", response_model=UserRead)
async def me(user: User = Depends(get_current_user)):
    return user
Swagger da Authorize tugmasi orqali login qilib, /auth/me ni sinang. 401 — kimligingiz tasdiqlanmadi, 403 — kimligingiz ma'lum, lekin ruxsat yo'q.

Mini-test

Yaroqsiz token bilan himoyalangan endpointga kirilsa qaysi status qaytadi?

401 Unauthorized: autentifikatsiya muvaffaqiyatsiz.

Session va JWT

Session

Server holatni saqlaydi, brauzerda cookie; serverni kengaytirish qiyinroq
VS

JWT token

Server holat saqlamaydi, token imzolangan; mobil va API uchun qulay; muddati tugaguncha bekor qilish qiyin

API lar uchun odatda JWT, an'anaviy saytlar uchun session.

Atamalar. Bosing

401

bosing

Autentifikatsiya yo'q yoki xato

403

bosing

Autentifikatsiya bor, lekin ruxsat yo'q

sub

bosing

JWT da foydalanuvchi identifikatori

exp

bosing

JWT amal qilish muddati

Autentifikatsiya qadamlari

1. Register

Parolni xeshlab, User yaratish.

2. Login

Parolni tekshirib, JWT berish.

3. Himoya

Depends(get_current_user) bilan endpointni yopish.

Status kodlar

KodMa'nosiQachon
201Createdmuvaffaqiyatli register
401Unauthorizedtoken yo'q yoki yaroqsiz
403Forbiddenadmin emas, ruxsat yo'q
409Conflictemail allaqachon band
422Validation Errormaydon noto'g'ri

Pastga bosing: Swagger da sinash

Swagger da sinash

  1. /docs da POST /auth/register ni bajaring.
  2. Authorize tugmasida email va parol bilan kiring.
  3. GET /auth/me ni bajaring: o'z ma'lumotingiz qaytadi.

Himoyalangan endpoint


@router.get("/me")
async def me():
    ...

Himoyalangan endpoint


@router.get("/me", response_model=UserRead)
async def me(user: User = Depends(get_current_user)):
    return user

Xavfsizlik raqamlarda

0
qism: JWT tuzilishi
0
daqiqa: access token muddati (config)
0
kod: yaroqsiz token

Token muddati access_token_expire_minutes sozlamasida.

Amaliy topshiriq 20 daqiqa

OsonTushunchalar: Quyidagilarni tasniflang: email kiritish, parol tekshirish, admin yo'liga ruxsat.
O'rtaRegister: /auth/register endpointini yozing: email band bo'lsa 409, aks holda 201 va parol xeshlansin.
QiyinLogin va me: /auth/login (JWT beradi) va get_current_user bilan himoyalangan /auth/me ni yozing.

Dars xulosasi

Uch tushuncha

Identifikatsiya, autentifikatsiya, avtorizatsiya.

Parol

bcrypt xesh, verify_password; ochiq saqlanmaydi.

JWT

/auth/login token beradi; get_current_user tekshiradi.

Uyga vazifa: register, login va /auth/me endpointlari.

Keyingi dars: CRUD amallari

Model, schema, validatsiya, endpointlar

5-hafta · 14-dars