Reference library

Auth & security at scale

OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.

5 matches

How to Implement Refresh Token Rotation in Python

A mock auth service that issues, rotates, and validates refresh tokens, revoking old tokens on reuse to prevent replay attacks.

auth oauth refresh-token

Python

import time
import hashlib
import secrets
from typing import Dict, Optional, Tuple


class MockTokenService:
    """Simulates refresh token rotation for a simple auth system."""

    def __init__(self):
        # Token hash -> (user_id, rotation_count, expires_at)
        self._active_tokens: Dict[str, Tuple[str, int,…

11 0 Open

Auth & security at scale medium

How to Implement a CSRF Token Double Submit Mock in Python

A mock CSRF protection class that generates and validates double-submit tokens using HMAC-SHA256 with a secret key.

csrf security hmac

Python

import hmac
import hashlib
import secrets


class CSRFProtection:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode("utf-8")

    def generate_token(self) -> str:
        random_value = secrets.token_hex(16)
        signature = hmac.new(
            self.secret_key, random_value.enco…

13 0 Open

Auth & security at scale easy

How to Revoke Tokens with a Blacklist Set in Python

A minimal TokenBlacklist class using a Python set to revoke, batch-revoke, check, and remove expired tokens for simple token invalidation.

jwt blacklist authentication

Python

import time

class TokenBlacklist:
    def __init__(self):
        self.blacklisted_tokens = set()

    def revoke(self, token):
        self.blacklisted_tokens.add(token)
        print(f"Token {token} revoked. Blacklist size: {len(self.blacklisted_tokens)}")

    def revoke_batch(self, tokens):
        before = len(s…

13 0 Open

Auth & security at scale easy

How to mock short TTL access tokens in Python

Simulate short-lived access tokens with a TTL, issue and validate them, and watch expiry behavior.

auth tokens expiry

Python

import time
import uuid
from datetime import datetime, timedelta


class AccessTokenManager:
    def __init__(self, ttl_seconds=30):
        self.ttl_seconds = ttl_seconds
        self.tokens = {}

    def issue_token(self):
        token_id = uuid.uuid4().hex
        expiry = datetime.now() + timedelta(seconds=self.t…

15 0 Open

Auth & security at scale medium

OAuth2 authorization code flow mock in Python

A minimal HTTP server that mocks the OAuth2 authorization code flow, issuing codes via /authorize and exchanging them for tokens at /token.

oauth2 http-server mock-server

Python

import json
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs

AUTH_CODE_STORE = {}
CLIENT_ID = "demo-client"
REDIRECT_URI = "http://localhost:8000/callback"

class OAuthHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        parsed = urlparse(self.path)
    …

14 0 Open

Browse by section

Each section groups closely related Python snippets.