Python Auth Security

Python Auth & Security

Overview

Security is not optional. OWASP Top 10 vulnerabilities remain the primary attack vector. This skill covers authentication, authorization, user management, and application security patterns for Python web apps. Every code pattern must follow these rules — no shortcuts.

Authentication Decision Framework

OAuth 2.0 / OIDC

Authlib is the recommended library (replaces deprecated Flask-OAuthlib).

Flows

Rule: Always use PKCE. The Implicit flow is deprecated and insecure.

Providers

JWT Best Practices

Password Security

Argon2id is the gold standard (OWASP + NIST SP 800-63B Rev 4, July 2025).

NIST SP 800-63B (2025): Minimum 8 characters, no complexity rules (they don't help), check against breached password lists, no forced rotation (change only on compromise).

RBAC Implementation

Database Schema

users (id, email, password_hash, is_active)
roles (id, name, description)
permissions (id, name, resource, action)
user_roles (user_id, role_id)
role_permissions (role_id, permission_id)

Predefined Roles

Flask Pattern

from functools import wraps

def permission_required(permission_name):
    def decorator(f):
        @wraps(f)
        def decorated(*args, **kwargs):
            if not current_user.has_permission(permission_name):
                abort(403)
            return f(*args, **kwargs)
        return decorated
    return decorator

@app.route('/admin/users')
@login_required
@permission_required('user.manage')
def manage_users():
    ...

For complex policies: Use PyCasbin (supports RBAC, ABAC, and custom models).

ABAC (Attribute-Based Access Control)

Use ABAC when RBAC isn't granular enough (e.g., "users can only edit their own resources" or "managers can approve orders under £10,000").

Tools: PyCasbin (PERM metamodel), OPA/Rego (policy-as-code via REST API), Vakt, Py-ABAC.

Multi-Tenant Isolation

Rule: Always filter by tenant_id at the query level, not the application level. PostgreSQL Row-Level Security (RLS) is the strongest guarantee:

ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON orders
    USING (tenant_id = current_setting('app.current_tenant')::int);

OWASP Top 10 Quick Reference

Input Validation

Rule: Validate at the boundary (API input), sanitize for output context (HTML, SQL, shell).

API Security

Security Scanning

Run in CI/CD: bandit -r app/ && pip-audit on every commit.

Dangerous Functions — NEVER Use

Anti-Patterns