Implementing secure authentication in modern async Python APIs is often fraught with subtle pitfalls: stateless tokens that cannot be revoked on logout, refresh token reuse, and missing brute-force protection.
fastapi-redis-auth-flow is a production-ready template and library providing bulletproof JWT authentication for FastAPI backed by high-speed Redis session tracking.
seotarek
/
fastapi-redis-auth-flow
Production-ready async JWT authentication & session management using FastAPI, Redis token blacklisting, and rate limiting.
FastAPI Redis Auth Flow 🔐⚡
A production-ready asynchronous authentication service using FastAPI, dual JWT access/refresh token rotation, and instant Redis session blacklisting.
Developed by Tarek Mohamed (@seotarek)
📌 Features
- 🔑 Dual Token Lifecycle: Short-lived access tokens (15m) and persistent refresh tokens (7d).
- 🚫 Instant Session Revocation: Immediate logout invalidation via Redis token blacklisting.
- ⚡ Asynchronous Redis Driver: Ultra-fast sub-millisecond session state checks with
redis.asyncio.
🚀 Quickstart
docker-compose up -d
Test login:
curl -X POST http://localhost:8000/login \
-H "Content-Type: application/json" \
-d '{"username": "admin", "password": "admin123"}'
📜 License
Licensed under the MIT License.
🔒 Security Best Practices Implemented
- Refresh Token Rotation: Every token refresh invalidates the previous refresh token; if a token is reused, all sessions are immediately revoked.
- Instant Revocation (Blacklisting): Immediate session termination across devices using Redis TTL keys.
-
Async & Non-Blocking: 100% async Python powered by
redis-pyandpydantic v2.
Check out the full repository and Docker Compose setup:
👉 https://github.com/seotarek/fastapi-redis-auth-flow
Top comments (0)