Auth & security at scale
OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.
How to Mock a TLS Certificate Rotation Schedule in Python
Simulate a TLS certificate rotation schedule with a Python class that tracks last and next rotation dates and decides when to rotate.
import datetime
import random
import time
class CertRotator:
def __init__(self, cert_name, rotation_days=30):
self.cert_name = cert_name
self.rotation_days = rotation_days
self.last_rotated = datetime.date.today() - datetime.timedelta(days=random.randint(10, 25))
self.next_rotatio…How to Revoke Tokens with a Blacklist Set in Python
A minimal TokenBlacklist class using a Python set to revoke, batch-revoke, check, and remove expired tokens for simple token invalidation.
import time
class TokenBlacklist:
def __init__(self):
self.blacklisted_tokens = set()
def revoke(self, token):
self.blacklisted_tokens.add(token)
print(f"Token {token} revoked. Blacklist size: {len(self.blacklisted_tokens)}")
def revoke_batch(self, tokens):
before = len(s…How to Salt Passwords per User in Python
Hash each user's password with a unique random salt using hashlib, and verify logins with timing-safe comparison.
import hashlib
import secrets
def hash_password(password: str, salt: str | None = None) -> tuple[str, str]:
"""Hash a password with a random salt (or provided salt).
Returns:
(salt_hex, password_hash_hex)
"""
if salt is None:
salt = secrets.token_hex(16)
salted = (salt + password)…How to Set X-Frame-Options DENY in Flask with a Mock Response
Set the X-Frame-Options header to DENY in a Flask response to prevent clickjacking, and verify it with Flask's test client.
from flask import Flask, Response
app = Flask(__name__)
@app.route("/")
def index():
response = Response("Hello, World!")
response.headers["X-Frame-Options"] = "DENY"
return response
if __name__ == "__main__":
with app.test_client() as client:
resp = client.get("/")
print(resp.get_da…How to Sign and Verify with Ed25519 in Python
A minimal Ed25519 sign-and-verify helper that generates a key pair, signs a message, and checks the signature with the cryptography library.
import hashlib
from cryptography.hazmat.primitives.asymmetric import ed25519
from cryptography.hazmat.primitives import serialization
def sign_verify_mock(
message: bytes,
private_key: ed25519.Ed25519PrivateKey,
public_key: ed25519.Ed25519PublicKey
) -> tuple[bool, bytes]:
signature = private_key.sign…How to Test X-Content-Type-Options nosniff in Python with Mocks
Mock httpx responses and verify that a server's X-Content-Type-Options header includes nosniff to prevent MIME sniffing.
import httpx
from unittest.mock import Mock, patch
def fetch_headers(url: str) -> dict:
response = httpx.get(url)
return dict(response.headers)
def mock_nosniff_check(response) -> bool:
content_type = response.headers.get("content-type", "")
x_content_type_options = response.headers.get("x-content-ty…How to Verify Passwords in Constant Time in Python
Use hmac.compare_digest to verify passwords in constant time, preventing timing attacks that could reveal password length or character positions.
import hmac
import time
# Mock of a constant-time password comparison (prevents timing attacks)
def verify_password(stored_password: str, supplied_password: str) -> bool:
# hmac.compare_digest runs in constant time (for a given length)
return hmac.compare_digest(stored_password.encode(), supplied_password.enc…How to implement OCSP stapling mock in Python
Simulate OCSP stapling with a caching mechanism that mocks certificate status lookups for TLS handshake validation.
import hashlib
import time
class OCSPStapler:
def __init__(self, cert_serial: str, issuer_hash: str):
self.cert_serial = cert_serial
self.issuer_hash = issuer_hash
self.cache = {}
def _mock_query_ocsp(self, serial: str) -> dict:
"""Simulate OCSP responder lookup."""
di…How to mock Argon2 password hashing in Python
This code demonstrates a mock Argon2 password hasher using HMAC-SHA256 iterations, providing hash and verify methods that mimic Argon2's salted, iterated derivation.
import hashlib
import hmac
import os
class Argon2Mock:
def __init__(self, salt_size=16, hash_len=32):
self.salt_size = salt_size
self.hash_len = hash_len
def hash(self, password: str, salt: bytes = None) -> str:
if salt is None:
salt = os.urandom(self.salt_size)
…How to mock DNS CAA record lookups in Python
Parse and filter DNS CAA records with a mock lookup function, demonstrating how certificate authorities validate domain authorization.
import dnslib
def parse_caa_record(record_string):
"""Parse a DNS CAA record string into its components."""
parts = record_string.split()
flags = int(parts[0])
tag = parts[1]
value = parts[2]
return flags, tag, value
def mock_caa_lookup(domain, caa_records):
"""Mock DNS CAA lookup that re…How to mock short TTL access tokens in Python
Simulate short-lived access tokens with a TTL, issue and validate them, and watch expiry behavior.
import time
import uuid
from datetime import datetime, timedelta
class AccessTokenManager:
def __init__(self, ttl_seconds=30):
self.ttl_seconds = ttl_seconds
self.tokens = {}
def issue_token(self):
token_id = uuid.uuid4().hex
expiry = datetime.now() + timedelta(seconds=self.t…How to redact secrets from log messages in Python
This code defines a logging.Filter subclass that automatically redacts sensitive keys like password, token, and API key from any dict logged.
import logging
from dataclasses import dataclass
@dataclass
class ApiResponse:
status: int
body: dict
class SecretRedactor(logging.Filter):
SENSITIVE_KEYS = {"password", "token", "secret", "api_key"}
def filter(self, record: logging.LogRecord) -> bool:
if isinstance(record.msg, dict):
…Implement RSA OAEP Padding in Python
Implements OAEP-style padding with MGF1 using SHA-256 from the Python standard library for RSA encryption prep.
import os
import hashlib
def mgf1(seed, length, hash_func=hashlib.sha256):
"""MGF1 mask generation function."""
output = b""
counter = 0
while len(output) < length:
c = counter.to_bytes(4, "big")
output += hash_func(seed + c).digest()
counter += 1
return output[:length]
…OAuth2 authorization code flow mock in Python
A minimal HTTP server that mocks the OAuth2 authorization code flow, issuing codes via /authorize and exchanging them for tokens at /token.
import json
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
AUTH_CODE_STORE = {}
CLIENT_ID = "demo-client"
REDIRECT_URI = "http://localhost:8000/callback"
class OAuthHandler(BaseHTTPRequestHandler):
def do_GET(self):
parsed = urlparse(self.path)
…Browse by section
Each section groups closely related Python snippets.
Auth & security at scale — Python code examples
What you will find here
This page collects auth & security at scale snippets — short, copy-ready Python you can paste into our free online IDE and run without installing anything. Each sample includes a plain-English explanation and the full source code.
Samples vs tutorials and challenges
Samples are quick reference — one concept per page. For step-by-step teaching, use our Python tutorials. To test yourself, try quizzes or coding challenges. Clean up style with the Python formatter.