CODEWITHSUNDEEP
pythonsecurityoauth-2.0jwtfastapi
user14681827
user14681827

Reputation: 153

Secure way of storing JWT secret key used to encode/decode token data

I'm building a Python application using FastApi and I'm using JWT and OAuth2 password flow to authenticate the users, as specified in their documentation. When a user logs in it receives a token, generated with HS256 algorithm and a user secret key. This token is stored as local storage in the browser. Then for each request that depends on the current logged in user, the token is send to the backend, decoded using the same secret key and the needed information is provided. In my app I have a PostgreSQL database and my question is where should I store those secret keys used to generate tokens for different type of users that I have and to keep those keys secured.

Thank you

Upvotes: 2

Views: 2477

Answers (1)

Basil C Sunny
Basil C Sunny

Reputation: 434

A recommended approach is to:

  • Create an .env file and store the SECRET in it
  • Create one settings.py file in root folder of the project
  • Import SECRET from .env to a variable in settings.py and use it

Upvotes: 2

Related Questions