Auth & security at scale
OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.
Build a Mock OIDC Userinfo Endpoint in Python with Flask
Create a local mock OIDC userinfo endpoint in Flask that returns a standard JSON user payload, ideal for testing auth flows without a real identity provider.
from flask import Flask, jsonify
app = Flask(__name__)
@app.route("/userinfo")
def userinfo():
mock_user = {
"sub": "1234567890",
"name": "John Doe",
"email": "john@example.com",
"email_verified": True,
"groups": ["admin", "dev"]
}
return jsonify(mock_user)
if __n…Fetch Secrets from a Mock Secrets Manager in Python
Build a minimal in-memory secrets manager that stores and retrieves secret values, raising a KeyError for missing names.
import json
class SecretsManager:
"""Mock secrets manager that returns secrets from a local store."""
def __init__(self, store=None):
self.store = store or {
"api_key": "mock-api-key-123",
"db_password": "s3cret-p@ss",
"jwt_secret": "dev-only-secret"
}
…How to Generate PKCE Code Challenge in Python
This Python script generates a PKCE code verifier and its corresponding S256 code challenge for secure OAuth2 authorization flows.
import base64
import hashlib
import os
import secrets
import string
def generate_code_verifier(length=64):
alphabet = string.ascii_letters + string.digits + "-._~"
return "".join(secrets.choice(alphabet) for _ in range(length))
def generate_code_challenge(code_verifier, method="S256"):
if method == "S256…How to Hash Passwords Securely in Python
Hash passwords with PBKDF2, random salts, and constant pepper, plus generate secure API keys using Python's stdlib.
import hashlib
import secrets
import time
import hmac
def hash_password(password: str, salt: str = None, pepper: str = "static-pepper") -> dict:
"""Hash a password with a random salt and constant pepper."""
if salt is None:
salt = secrets.token_hex(16)
salted = f"{pepper}{salt}{password}"
dig…How to Hash Passwords with bcrypt in Python
Hash a plaintext password with bcrypt using a randomly generated salt, then verify a plaintext attempt against the stored hash.
import bcrypt
def hash_password(password: str) -> str:
"""Hash a password using bcrypt with a generated salt."""
salt = bcrypt.gensalt()
return bcrypt.hashpw(password.encode("utf-8"), salt).decode("utf-8")
def check_password(password: str, hashed: str) -> bool:
"""Verify a plaintext password against …How to Hash and Verify Passwords in Python
Hash passwords securely with PBKDF2-SHA256 and verify them using a constant-time comparison.
import hashlib
import hmac
import secrets
from typing import Tuple
def hash_password(password: str, salt: str = None) -> Tuple[str, str]:
"""Hash a password with a random salt using PBKDF2-SHA256."""
salt = salt or secrets.token_hex(16)
hashed = hashlib.pbkdf2_hmac(
"sha256", password.encode("utf…How to Revoke Tokens with a Blacklist Set in Python
A minimal TokenBlacklist class using a Python set to revoke, batch-revoke, check, and remove expired tokens for simple token invalidation.
import time
class TokenBlacklist:
def __init__(self):
self.blacklisted_tokens = set()
def revoke(self, token):
self.blacklisted_tokens.add(token)
print(f"Token {token} revoked. Blacklist size: {len(self.blacklisted_tokens)}")
def revoke_batch(self, tokens):
before = len(s…How to Salt Passwords per User in Python
Hash each user's password with a unique random salt using hashlib, and verify logins with timing-safe comparison.
import hashlib
import secrets
def hash_password(password: str, salt: str | None = None) -> tuple[str, str]:
"""Hash a password with a random salt (or provided salt).
Returns:
(salt_hex, password_hash_hex)
"""
if salt is None:
salt = secrets.token_hex(16)
salted = (salt + password)…How to Verify Passwords in Constant Time in Python
Use hmac.compare_digest to verify passwords in constant time, preventing timing attacks that could reveal password length or character positions.
import hmac
import time
# Mock of a constant-time password comparison (prevents timing attacks)
def verify_password(stored_password: str, supplied_password: str) -> bool:
# hmac.compare_digest runs in constant time (for a given length)
return hmac.compare_digest(stored_password.encode(), supplied_password.enc…How to mock short TTL access tokens in Python
Simulate short-lived access tokens with a TTL, issue and validate them, and watch expiry behavior.
import time
import uuid
from datetime import datetime, timedelta
class AccessTokenManager:
def __init__(self, ttl_seconds=30):
self.ttl_seconds = ttl_seconds
self.tokens = {}
def issue_token(self):
token_id = uuid.uuid4().hex
expiry = datetime.now() + timedelta(seconds=self.t…Browse by section
Each section groups closely related Python snippets.
Auth & security at scale — Python code examples
What you will find here
This page collects auth & security at scale snippets — short, copy-ready Python you can paste into our free online IDE and run without installing anything. Each sample includes a plain-English explanation and the full source code.
Samples vs tutorials and challenges
Samples are quick reference — one concept per page. For step-by-step teaching, use our Python tutorials. To test yourself, try quizzes or coding challenges. Clean up style with the Python formatter.