Reference library

Auth & security at scale

OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.

5 matches

How to Hash Passwords and Authenticate Users in Python

A beginner-friendly dataclass-based design that hashes passwords with PBKDF2 and verifies them securely using constant-time comparisons.

security password hashing pbkdf2

Python

import hashlib
import hmac
import secrets
from dataclasses import dataclass
from typing import Optional


@dataclass
class User:
    id: int
    username: str
    password_hash: str
    salt: str


def hash_password(password: str) -> tuple[str, str]:
    salt = secrets.token_hex(16)
    password_hash = hashlib.pbkdf2_…

16 0 Open

Auth & security at scale medium

How to Implement a CSRF Token Double Submit Mock in Python

A mock CSRF protection class that generates and validates double-submit tokens using HMAC-SHA256 with a secret key.

csrf security hmac

Python

import hmac
import hashlib
import secrets


class CSRFProtection:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode("utf-8")

    def generate_token(self) -> str:
        random_value = secrets.token_hex(16)
        signature = hmac.new(
            self.secret_key, random_value.enco…

13 0 Open

Auth & security at scale medium

How to Implement a Vault Dynamic Database Credentials Mock in Python

A Python dataclass-based mock of HashiCorp Vault that issues short-lived database credentials, tracks leases, and revokes them, demonstrating dynamic secrets rotation.

vault secrets database

Python

import time
import json
from dataclasses import dataclass, field
from typing import Dict


@dataclass
class DynamicCredential:
    username: str
    password: str
    lease_duration: int
    created_at: float = field(default_factory=time.time)

    def is_valid(self) -> bool:
        return time.time() - self.created_…

16 0 Open

Auth & security at scale medium

How to Mock a Redis Session Store in Python

An in-memory RedisSessionStore class with TTL-based expiry, get/set/delete/exists methods, and JSON field support—perfect for testing and prototyping without a live Redis.

redis session mock

Python

import time
import json
from collections import defaultdict


class RedisSessionStore:
    """In-memory mock of a Redis-backed session store."""

    def __init__(self, ttl=3600):
        self._data = defaultdict(dict)
        self._expires = {}
        self._ttl = ttl

    def set(self, session_id, field, value):
   …

12 0 Open

Auth & security at scale medium

How to redact secrets from log messages in Python

This code defines a logging.Filter subclass that automatically redacts sensitive keys like password, token, and API key from any dict logged.

logging security redaction

Python

import logging
from dataclasses import dataclass


@dataclass
class ApiResponse:
    status: int
    body: dict


class SecretRedactor(logging.Filter):
    SENSITIVE_KEYS = {"password", "token", "secret", "api_key"}

    def filter(self, record: logging.LogRecord) -> bool:
        if isinstance(record.msg, dict):
    …

12 0 Open

Browse by section

Each section groups closely related Python snippets.