Reference library

Auth & security at scale

OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.

6 matches

How to Create and Verify an OpenID Connect ID Token in Python

Generate and validate a mock OpenID Connect ID token (JWT) with HS256 signing using only the Python standard library.

import base64
import hashlib
import hmac
import json
import time
from typing import Optional


def b64url_encode(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")


def b64url_decode(data: str) -> bytes:
    padding = "=" * (-len(data) % 4)
    return base64.urlsafe_b64decode(…

14 0 Open

Auth & security at scale medium

How to Implement Refresh Token Rotation in Python

A mock auth service that issues, rotates, and validates refresh tokens, revoking old tokens on reuse to prevent replay attacks.

auth oauth refresh-token

Python

import time
import hashlib
import secrets
from typing import Dict, Optional, Tuple


class MockTokenService:
    """Simulates refresh token rotation for a simple auth system."""

    def __init__(self):
        # Token hash -> (user_id, rotation_count, expires_at)
        self._active_tokens: Dict[str, Tuple[str, int,…

11 0 Open

Auth & security at scale medium

How to Implement a CSRF Token Double Submit Mock in Python

A mock CSRF protection class that generates and validates double-submit tokens using HMAC-SHA256 with a secret key.

csrf security hmac

Python

import hmac
import hashlib
import secrets


class CSRFProtection:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode("utf-8")

    def generate_token(self) -> str:
        random_value = secrets.token_hex(16)
        signature = hmac.new(
            self.secret_key, random_value.enco…

13 0 Open

Auth & security at scale medium

How to redact secrets from log messages in Python

This code defines a logging.Filter subclass that automatically redacts sensitive keys like password, token, and API key from any dict logged.

logging security redaction

Python

import logging
from dataclasses import dataclass


@dataclass
class ApiResponse:
    status: int
    body: dict


class SecretRedactor(logging.Filter):
    SENSITIVE_KEYS = {"password", "token", "secret", "api_key"}

    def filter(self, record: logging.LogRecord) -> bool:
        if isinstance(record.msg, dict):
    …

12 0 Open

Auth & security at scale medium

Mock client credentials machine auth in Python

This code simulates the OAuth2 client-credentials flow for service-to-service calls, generating a mock bearer token with expiry and caching, plus a revoke method, using only the standard library.

oauth2 auth mock

Python

import time
import hashlib
import secrets

class MachineAuth:
    """Mock client-credentials machine auth for service-to-service calls."""
    
    def __init__(self, client_id, client_secret):
        self.client_id = client_id
        self.client_secret = client_secret
        self._token = None
        self._expire…

15 0 Open

Auth & security at scale medium

OAuth2 authorization code flow mock in Python

A minimal HTTP server that mocks the OAuth2 authorization code flow, issuing codes via /authorize and exchanging them for tokens at /token.

oauth2 http-server mock-server

Python

import json
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs

AUTH_CODE_STORE = {}
CLIENT_ID = "demo-client"
REDIRECT_URI = "http://localhost:8000/callback"

class OAuthHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        parsed = urlparse(self.path)
    …

15 0 Open

Browse by section

Each section groups closely related Python snippets.