Skip to content

OAuth2Strategy

Logins with GitHub or any OAuth2 provider: pip install "fastapi-alcazaba[auth-strategy-oauth2]". For an OpenID Connect provider (Google, Entra ID, Keycloak…), OIDCStrategy verifies its ID token too.

In an app: the example. How strategies are tried, and the code of a login with GitHub: Strategies. Every argument: the API reference.

OAuth2Strategy logs people in with the authorization code flow and PKCE, for any OAuth2 provider (GitHub, GitLab…). It doesn't verify an id_token the provider may send: don't rely on its claims, and use OIDCStrategy, which does, for OpenID Connect providers.

  • The login: redirect() sends the browser to the provider with a random state; the state and the PKCE verifier wait in a cookie for 10 minutes (__Host-, HttpOnly, SameSite=Lax).
  • The callback: the strategy checks the state, so that nobody can log a user in with their own account (login CSRF); exchanges the code, with the app's credentials by HTTP Basic (client_auth="post" in the form); reads userinfo_url; and calls verify(tokens, profile). It only goes on the callback route: elsewhere it finds nobody.
  • The provider: its URLs are HTTPS (or http://localhost); a provider that doesn't answer is a 502.