Security authentication is essential when building modern web apps. Let's look at the JWT auth middleware in fba: backend/middleware/jwt_auth_middleware.py — a best practice you can apply in enterprise projects.

What Problem Does It Solve?

If you are building an API that needs user login, you need to:

• Verify user identity
• Protect sensitive endpoints
• Keep user state across requests
• Handle auth failures gracefully
• ......

Traditional approaches often require repeating auth logic in every endpoint, or wrapping route functions with decorators. Our JWT middleware offers a cleaner integration: configure once, apply globally.

How to Use It?

In fba, for example, we provide a unified middleware registration entry:

def register_middleware(app: FastAPI) -> None:
    # ...other middleware
    app.add_middleware(
        AuthenticationMiddleware,  # Auth middleware from starlette
        backend=JwtAuthMiddleware(),  # Custom middleware backend
        on_error=JwtAuthMiddleware.auth_exception_handler,  # Custom error handler
    )

Then in route functions, read the current user via request.user:

@router.get("/profile")
async def get_profile(request: Request):
    # User info is already injected into the request by middleware
    current_user = request.user
    return {"user": current_user}

No tedious dependency injection, no repeated auth code — everything stays simple.

Differences from the Official FastAPI Approach

FastAPI officially recommends OAuth2PasswordBearer and the dependency injection system for JWT auth:

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@router.get("/users/me")
async def get_profile(current_user: User = Depends(get_current_user)):
    return current_user

Compared with JWT auth middleware, it may look like only a few fewer lines of code, but the differences underneath are large:

1. Global consistency: Middleware ensures every request goes through the same auth flow, avoiding omissions
2. Unified error handling: A custom error handler keeps all auth failures in a consistent response format
3. Cleaner code: Route functions no longer depend explicitly on auth logic — concerns are better separated
4. Flexible extension: Middleware architecture makes adding new auth methods or permission checks simple

Why Recommend JWT Middleware?

In real projects, this middleware-based JWT approach has clear advantages:

Developer-Friendly

fba always cares about this. With this middleware, new team members do not need to understand complex auth internals — they only need to know that request.user holds the current user. That lowers the onboarding bar and reduces potential security holes.

Unified Error Handling

All auth-related errors go through one handler, ensuring API response consistency. Whether the token is expired or malformed, clients get a uniformly formatted error.

Performance Considerations

Middleware runs auth only when needed. Whitelisted paths (login, health checks, etc.) are skipped automatically to avoid unnecessary overhead. Redis and Rust libraries are also used to cache and parse user info, keeping performance impact as low as possible.

Notes

This middleware is flexible enough for many extensions, but it applies to every API request (except unauthenticated requests and whitelisted APIs), so always consider applicability and performance when extending it.

编辑此页面