Secure way of storing JWT secret key used to encode/decode token data

user_14681827 0
Viewed 843

I'm building a Python application using FastApi and I'm using JWT and OAuth2 password flow to authenticate the users, as specified in their documentation. When a user logs in it receives a token, generated with HS256 algorithm and a user secret key. This token is stored as local storage in the browser. Then for each request that depends on the current logged in user, the token is send to the backend, decoded using the same secret key and the needed information is provided. In my app I have a PostgreSQL database and my question is where should I store those secret keys used to generate tokens for different type of users that I have and to keep those keys secured.

Thank you

fastapi jwt oauth-2.0 security python
1 Answers

A recommended approach is to:

  • Create an .env file and store the SECRET in it
  • Create one settings.py file in root folder of the project
  • Import SECRET from .env to a variable in settings.py and use it
user_20317910
Related