{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/guest-post/securing-flask-api-with-jwt/","result":{"data":{"markdownRemark":{"id":"493661c3-a0e2-5195-aaa2-674b3eb14e67","excerpt":"Authentication is an essential part of any web application. But unfortunately, it is not always easy to implement. What is Authentication? Authentication is a…","html":"

Authentication is an essential part of any web application. But unfortunately, it is not always easy to implement.

\n

What is Authentication?

\n

Authentication is a process of verifying that an entity is who they claim to be. For example, a user might authenticate by providing a username and password. If the username and password are valid, the system will check if the user can access the resource. After the system checks the user's details against its database and if the details are valid, the user is thus authenticated and can access available resources.

\n

Authentication Factors

\n

The following factors are used to authenticate a user.

\n

Single-factor Authentication

\n

This authentication is used when a user provides a username/email/phone number and a password. This is the most common and weakest authentication factor. The user simply inputs the email and password, and the system checks if the data is valid; if valid, the user gets authenticated and can access the resource. What happens if another person who is not a legitimate user tries to access the resource? The system denies access to the resource.

\n

Multi-factor Authentication

\n

This authentication uses more than one factor to authenticate a user. For example, the user tries to log in with, say, email and password; if the data is correct, a code is sent to the user's phone number, and the user is asked to input the code. If the user enters the code, the user gets logged in; otherwise, the user is not authenticated. Some applications even go a step further by not using two factors but using three factors.

\n

Types of Authentication

\n

There are three types of authentication, as follows:

\n
    \n
  1. Knowledge Authentication: The user is asked something that only they can provide or know -- e.g., password. This is the most common type and also the easiest.
    2. \n
  2. Property Authentication: The user is asked for something they own or possess. For example, they can use a hardware authentication device like YubiKey or an authenticator app on their phone. The idea is that users will be asked to set an authentication factor that verifies the identity more securely. This isn’t always used alone; it’s used alongside another authentication type, say, Knowledge authentication.
    3. \n
  3. Biological Authentication: The user is asked to verify their identity using something biologically unique to them -- e.g., a fingerprint or iris scan.
    4. \n
\n

In most applications, knowledge and property authentication are used as an extra layer of authentication.

\n

Authentication vs. Authorization

\n

The following are the differences between authentication and authorization:

\n
    \n
  1. Authentication verifies identity (usually through credential validation)) while authorization grants or denies permissions to a user.
    2. \n
  2. Authentication is used to verify that users are who they say they are. Authorization is used to verify that a user has permission to do something.
    3. \n
\n

Starter Application

\n

In this tutorial, you'll work on authentication in flask middleware for an existing API built with Flask and PyMongo. The API is a book library API using which users can create books and upload cover images for the books and relevant data. PyMongo is used to connect to the mongo database. You'll use the PyJWT library to generate and verify JWT tokens for auth in flask.

\n
\n

You can learn more about JSON Web Tokens (JWT) here.

\n
\n

To get started, clone the repository and set up the application by running the following commands:

\n
git clone https://github.com/LoginRadius/engineering-blog-samples.git # Clone the repository\ncd /Flask/loginRadius-flask-auth # change directory\npython3 -m venv env # create virtual environment; if you're using Windows, `py -m venv env`\nsource env/bin/activate # activate virtual environment, if you're using windows, env/Scripts/activate\npip install -r requirements.txt # install dependencies\n# https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/
\n

The application is now set up and ready to run. You can run the app using the command flask run in the project directory. You can test that all the endpoints are working by testing the app in an API testing tool, like Postman.

\n

Authentication Middleware

\n

As you've noticed, anybody can access the API; you need to restrict access to the API. Create new book data if they have the correct data, then add, delete, and update book data, but you don't want that. To do this, you need to implement an authentication middleware.

\n

When we talk about authentication with flask, middlewares are created in Flask by creating a decorator; a function can have multiple middlewares, and the order matters a lot.

\n

To create your auth middleware, you need to install PyJWT -- the library you'll use to generate tokens. You’ll also use Pillow to alter image data before saving them to disk. Run the following command to install the packages:

\n
pip install pyjwt pillow
\n

You need to add a secret key to your application; this is what you should pass to JWT.

\n

Add the following to your app.py file below the app declaration.

\n
# app = Flask(__name__)\n\nSECRET_KEY = os.environ.get('SECRET_KEY') or 'this is a secret'\nprint(SECRET_KEY)\napp.config['SECRET_KEY'] = SECRET_KEY
\n

Let's create a file called auth_middleware.py in the root of your application and place the following inside this file:

\n
from functools import wraps\nimport jwt\nfrom flask import request, abort\nfrom flask import current_app\nimport models\n\ndef token_required(f):\n    @wraps(f)\n    def decorated(*args, **kwargs):\n        token = None\n        if "Authorization" in request.headers:\n            token = request.headers["Authorization"].split(" ")[1]\n        if not token:\n            return {\n                "message": "Authentication Token is missing!",\n                "data": None,\n                "error": "Unauthorized"\n            }, 401\n        try:\n            data=jwt.decode(token, current_app.config["SECRET_KEY"], algorithms=["HS256"])\n            current_user=models.User().get_by_id(data["user_id"])\n            if current_user is None:\n                return {\n                "message": "Invalid Authentication token!",\n                "data": None,\n                "error": "Unauthorized"\n            }, 401\n            if not current_user["active"]:\n                abort(403)\n        except Exception as e:\n            return {\n                "message": "Something went wrong",\n                "data": None,\n                "error": str(e)\n            }, 500\n\n        return f(current_user, *args, **kwargs)\n\n    return decorated
\n

The function above is simply a decorator function. Inside this function, you check if there is an Authorization field in the headers part of the request; if this is missing, you return an authorization error.

\n

Next, you check if it exists but is not valid; if it is not valid, you also return an authorization error.

\n

If everything goes fine, then the view function is called. As you can see, you return f(current_user, *args, **kwargs), where f is the next decorator or function that's being called after this decorator -- in your case, the view function, which means that the first argument of any view function that uses this decorator must be current_user.

\n

Auth Routes

\n

You currently have a route to creating a new user, but you don't have one to log in. From what you have above, you're checking if the token passed as the header is valid, but now the question is -- how do you get to know the token. Basically, the login route fetches the token and sends it to the client.

\n

Add the following function below the add_user function:

\n
@app.route("/users/login", methods=["POST"])\ndef login():\n    try:\n        data = request.json\n        if not data:\n            return {\n                "message": "Please provide user details",\n                "data": None,\n                "error": "Bad request"\n            }, 400\n        # validate input\n        is_validated = validate_email_and_password(data.get('email'), data.get('password'))\n        if is_validated is not True:\n            return dict(message='Invalid data', data=None, error=is_validated), 400\n        user = User().login(\n            data["email"],\n            data["password"]\n        )\n        if user:\n            try:\n                # token should expire after 24 hrs\n                user["token"] = jwt.encode(\n                    {"user_id": user["_id"]},\n                    app.config["SECRET_KEY"],\n                    algorithm="HS256"\n                )\n                return {\n                    "message": "Successfully fetched auth token",\n                    "data": user\n                }\n            except Exception as e:\n                return {\n                    "error": "Something went wrong",\n                    "message": str(e)\n                }, 500\n        return {\n            "message": "Error fetching auth token!, invalid email or password",\n            "data": None,\n            "error": "Unauthorized"\n        }, 404\n    except Exception as e:\n        return {\n                "message": "Something went wrong!",\n                "error": str(e),\n                "data": None\n        }, 500
\n

Protecting API Routes in Flask

\n

So far, you've been able to create your auth middleware, but you need to use this middleware to protect routes. All you need to do is to pass this middleware immediately after the app.route middleware, then make current_user the first argument of the view function, as follows:

\n
@app.route('/')\n@token_required\ndef user(current_user):\n  return jsonify(current_user)\n\n@app.route('/<pdt_id>')\n@token_required\ndef product(current_user, pdt_id):\n  return jsonify(Product.find({'user_id': pdt_id}))
\n

Add this middleware (@token_required) to every function you only want authenticated users to access. In the end, your whole app.py file should look as follows.

\n
import jwt, os\nfrom dotenv import load_dotenv\nfrom flask import Flask, request, jsonify\nfrom save_image import save_pic\nfrom validate import validate_book, validate_email_and_password, validate_user\n\nload_dotenv()\n\napp = Flask(__name__)\nSECRET_KEY = os.environ.get('SECRET_KEY') or 'this is a secret'\nprint(SECRET_KEY)\napp.config['SECRET_KEY'] = SECRET_KEY\n\nfrom models import Books, User\nfrom auth_middleware import token_required\n\n@app.route("/")\ndef hello():\n    return "Hello World!"\n\n@app.route("/users/", methods=["POST"])\ndef add_user():\n    try:\n        user = request.json\n        if not user:\n            return {\n                "message": "Please provide user details",\n                "data": None,\n                "error": "Bad request"\n            }, 400\n        is_validated = validate_user(**user)\n        if is_validated is not True:\n            return dict(message='Invalid data', data=None, error=is_validated), 400\n        user = User().create(**user)\n        if not user:\n            return {\n                "message": "User already exists",\n                "error": "Conflict",\n                "data": None\n            }, 409\n        return {\n            "message": "Successfully created new user",\n            "data": user\n        }, 201\n    except Exception as e:\n        return {\n            "message": "Something went wrong",\n            "error": str(e),\n            "data": None\n        }, 500\n\n@app.route("/users/login", methods=["POST"])\ndef login():\n    try:\n        data = request.json\n        if not data:\n            return {\n                "message": "Please provide user details",\n                "data": None,\n                "error": "Bad request"\n            }, 400\n        # validate input\n        is_validated = validate_email_and_password(data.get('email'), data.get('password'))\n        if is_validated is not True:\n            return dict(message='Invalid data', data=None, error=is_validated), 400\n        user = User().login(\n            data["email"],\n            data["password"]\n        )\n        if user:\n            try:\n                # token should expire after 24 hrs\n                user["token"] = jwt.encode(\n                    {"user_id": user["_id"]},\n                    app.config["SECRET_KEY"],\n                    algorithm="HS256"\n                )\n                return {\n                    "message": "Successfully fetched auth token",\n                    "data": user\n                }\n            except Exception as e:\n                return {\n                    "error": "Something went wrong",\n                    "message": str(e)\n                }, 500\n        return {\n            "message": "Error fetching auth token!, invalid email or password",\n            "data": None,\n            "error": "Unauthorized"\n        }, 404\n    except Exception as e:\n        return {\n                "message": "Something went wrong!",\n                "error": str(e),\n                "data": None\n        }, 500\n\n\n@app.route("/users/", methods=["GET"])\n@token_required\ndef get_current_user(current_user):\n    return jsonify({\n        "message": "successfully retrieved user profile",\n        "data": current_user\n    })\n\n@app.route("/users/", methods=["PUT"])\n@token_required\ndef update_user(current_user):\n    try:\n        user = request.json\n        if user.get("name"):\n            user = User().update(current_user["_id"], user["name"])\n            return jsonify({\n                "message": "successfully updated account",\n                "data": user\n            }), 201\n        return {\n            "message": "Invalid data, you can only update your account name!",\n            "data": None,\n            "error": "Bad Request"\n        }, 400\n    except Exception as e:\n        return jsonify({\n            "message": "failed to update account",\n            "error": str(e),\n            "data": None\n        }), 400\n\n@app.route("/users/", methods=["DELETE"])\n@token_required\ndef disable_user(current_user):\n    try:\n        User().disable_account(current_user["_id"])\n        return jsonify({\n            "message": "successfully disabled acount",\n            "data": None\n        }), 204\n    except Exception as e:\n        return jsonify({\n            "message": "failed to disable account",\n            "error": str(e),\n            "data": None\n        }), 400\n\n@app.route("/books/", methods=["POST"])\n@token_required\ndef add_book(current_user):\n    try:\n        book = dict(request.form)\n        if not book:\n            return {\n                "message": "Invalid data, you need to give the book title, cover image, author id,",\n                "data": None,\n                "error": "Bad Request"\n            }, 400\n        if not request.files["cover_image"]:\n            return {\n                "message": "cover image is required",\n                "data": None\n            }, 400\n\n        book["image_url"] = request.host_url+"static/books/"+save_pic(request.files["cover_image"])\n        book["user_id"] = current_user["_id"]\n        is_validated = validate_book(**book)\n        if is_validated is not True:\n            return {\n                "message": "Invalid data",\n                "data": None,\n                "error": is_validated\n            }, 400\n        book = Books().create(**book)\n        if not book:\n            return {\n                "message": "The book has been created by user",\n                "data": None,\n                "error": "Conflict"\n            }, 400\n        return jsonify({\n            "message": "successfully created a new book",\n            "data": book\n        }), 201\n    except Exception as e:\n        return jsonify({\n            "message": "failed to create a new book",\n            "error": str(e),\n            "data": None\n        }), 500\n\n@app.route("/books/", methods=["GET"])\n@token_required\ndef get_books(current_user):\n    try:\n        books = Books().get_by_user_id(current_user["_id"])\n        return jsonify({\n            "message": "successfully retrieved all books",\n            "data": books\n        })\n    except Exception as e:\n        return jsonify({\n            "message": "failed to retrieve all books",\n            "error": str(e),\n            "data": None\n        }), 500\n\n@app.route("/books/<book_id>", methods=["GET"])\n@token_required\ndef get_book(current_user, book_id):\n    try:\n        book = Books().get_by_id(book_id)\n        if not book:\n            return {\n                "message": "Book not found",\n                "data": None,\n                "error": "Not Found"\n            }, 404\n        return jsonify({\n            "message": "successfully retrieved a book",\n            "data": book\n        })\n    except Exception as e:\n        return jsonify({\n            "message": "Something went wrong",\n            "error": str(e),\n            "data": None\n        }), 500\n\n@app.route("/books/<book_id>", methods=["PUT"])\n@token_required\ndef update_book(current_user, book_id):\n    try:\n        book = Books().get_by_id(book_id)\n        if not book or book["user_id"] != current_user["_id"]:\n            return {\n                "message": "Book not found for user",\n                "data": None,\n                "error": "Not found"\n            }, 404\n        book = request.form\n        if book.get('cover_image'):\n            book["image_url"] = request.host_url+"static/books/"+save_pic(request.files["cover_image"])\n        book = Books().update(book_id, **book)\n        return jsonify({\n            "message": "successfully updated a book",\n            "data": book\n        }), 201\n    except Exception as e:\n        return jsonify({\n            "message": "failed to update a book",\n            "error": str(e),\n            "data": None\n        }), 400\n\n@app.route("/books/<book_id>", methods=["DELETE"])\n@token_required\ndef delete_book(current_user, book_id):\n    try:\n        book = Books().get_by_id(book_id)\n        if not book or book["user_id"] != current_user["_id"]:\n            return {\n                "message": "Book not found for user",\n                "data": None,\n                "error": "Not found"\n            }, 404\n        Books().delete(book_id)\n        return jsonify({\n            "message": "successfully deleted a book",\n            "data": None\n        }), 204\n    except Exception as e:\n        return jsonify({\n            "message": "failed to delete a book",\n            "error": str(e),\n            "data": None\n        }), 400\n\n@app.errorhandler(403)\ndef forbidden(e):\n    return jsonify({\n        "message": "Forbidden",\n        "error": str(e),\n        "data": None\n    }), 403\n\n@app.errorhandler(404)\ndef forbidden(e):\n    return jsonify({\n        "message": "Endpoint Not Found",\n        "error": str(e),\n        "data": None\n    }), 404\n\n\nif __name__ == "__main__":\n    app.run(debug=True)
\n

Before running the application, let's look at the save_pic function inside the save_image.py file. This is the function responsible for saving uploaded pictures.

\n
from PIL import Image\nimport secrets, os\nfrom flask import current_app as app\n\ndef save_pic(picture):\n    file_name = secrets.token_hex(8) +os.path.splitext(picture.filename)[1]\n    if not os.path.isdir(os.path.join(app.root_path, 'static')):\n        os.mkdir(os.path.join(app.root_path,"static"))\n        os.mkdir(os.path.join(app.root_path,"static/images"))\n        os.mkdir(os.path.join(app.root_path,"static/images/books"))\n    if not os.path.isdir(os.path.join(app.root_path, 'static/images')):\n        os.mkdir(os.path.join(app.root_path,"static/images"))\n        os.mkdir(os.path.join(app.root_path,"static/images/books"))\n    if not os.path.isdir(os.path.join(app.root_path, 'static/images/books')):\n        os.mkdir(os.path.join(app.root_path,"static/images/books"))\n    file_path = os.path.join(app.root_path, "static/images/books", file_name)\n    picture = Image.open(picture)\n    picture.thumbnail((150, 150))\n    picture.save(file_path)\n    return file_name
\n

You should also add the following functions as helper methods of the User model class.

\n
def disable_account(self, user_id):\n    user = db.users.update_one(\n        {"_id": bson.ObjectId(user_id)},\n        {"$set": {"active": False}}\n    )\n    user = self.get_by_id(user_id)\n    return user\n\ndef encrypt_password(self, password):\n    return generate_password_hash(password)\n\ndef login(self, email, password):\n    """Login a user"""\n    user = self.get_by_email(email)\n    if not user or not check_password_hash(user["password"], password):\n        return\n    user.pop("password")\n    return user
\n

Your models.py file should look as follows:

\n
"""Application Models"""\nimport bson, os\nfrom dotenv import load_dotenv\nfrom pymongo import MongoClient\nfrom werkzeug.security import generate_password_hash, check_password_hash\n\nload_dotenv()\n\nDATABASE_URL=os.environ.get('DATABASE_URL') or 'mongodb://localhost:27017/myDatabase'\nprint(DATABASE_URL)\nclient = MongoClient(DATABASE_URL)\ndb = client.myDatabase\n\nclass Books:\n    """Books Model"""\n    def __init__(self):\n        return\n\n    def create(self, title="", description="", image_url="", category="", user_id=""):\n        """Create a new book"""\n        book = self.get_by_user_id_and_title(user_id, title)\n        if book:\n            return\n        new_book = db.books.insert_one(\n            {\n                "title": title,\n                "description": description,\n                "image_url": image_url,\n                "category": category,\n                "user_id": user_id\n            }\n        )\n        return self.get_by_id(new_book.inserted_id)\n\n    def get_all(self):\n        """Get all books"""\n        books = db.books.find()\n        return [{**book, "_id": str(book["_id"])} for book in books]\n\n    def get_by_id(self, book_id):\n        """Get a book by id"""\n        book = db.books.find_one({"_id": bson.ObjectId(book_id)})\n        if not book:\n            return\n        book["_id"] = str(book["_id"])\n        return book\n\n    def get_by_user_id(self, user_id):\n        """Get all books created by a user"""\n        books = db.books.find({"user_id": user_id})\n        return [{**book, "_id": str(book["_id"])} for book in books]\n\n    def get_by_category(self, category):\n        """Get all books by category"""\n        books = db.books.find({"category": category})\n        return [book for book in books]\n\n    def get_by_user_id_and_category(self, user_id, category):\n        """Get all books by category for a particular user"""\n        books = db.books.find({"user_id": user_id, "category": category})\n        return [{**book, "_id": str(book["_id"])} for book in books]\n\n    def get_by_user_id_and_title(self, user_id, title):\n        """Get a book given its title and author"""\n        book = db.books.find_one({"user_id": user_id, "title": title})\n        if not book:\n            return\n        book["_id"] = str(book["_id"])\n        return book\n\n    def update(self, book_id, title="", description="", image_url="", category="", user_id=""):\n        """Update a book"""\n        data={}\n        if title: data["title"]=title\n        if description: data["description"]=description\n        if image_url: data["image_url"]=image_url\n        if category: data["category"]=category\n\n        book = db.books.update_one(\n            {"_id": bson.ObjectId(book_id)},\n            {\n                "$set": data\n            }\n        )\n        book = self.get_by_id(book_id)\n        return book\n\n    def delete(self, book_id):\n        """Delete a book"""\n        book = db.books.delete_one({"_id": bson.ObjectId(book_id)})\n        return book\n\n    def delete_by_user_id(self, user_id):\n        """Delete all books created by a user"""\n        book = db.books.delete_many({"user_id": bson.ObjectId(user_id)})\n        return book\n\n\nclass User:\n    """User Model"""\n    def __init__(self):\n        return\n\n    def create(self, name="", email="", password=""):\n        """Create a new user"""\n        user = self.get_by_email(email)\n        if user:\n            return\n        new_user = db.users.insert_one(\n            {\n                "name": name,\n                "email": email,\n                "password": self.encrypt_password(password),\n                "active": True\n            }\n        )\n        return self.get_by_id(new_user.inserted_id)\n\n    def get_all(self):\n        """Get all users"""\n        users = db.users.find({"active": True})\n        return [{**user, "_id": str(user["_id"])} for user in users]\n\n    def get_by_id(self, user_id):\n        """Get a user by id"""\n        user = db.users.find_one({"_id": bson.ObjectId(user_id), "active": True})\n        if not user:\n            return\n        user["_id"] = str(user["_id"])\n        user.pop("password")\n        return user\n\n    def get_by_email(self, email):\n        """Get a user by email"""\n        user = db.users.find_one({"email": email, "active": True})\n        if not user:\n            return\n        user["_id"] = str(user["_id"])\n        return user\n\n    def update(self, user_id, name=""):\n        """Update a user"""\n        data = {}\n        if name:\n            data["name"] = name\n        user = db.users.update_one(\n            {"_id": bson.ObjectId(user_id)},\n            {\n                "$set": data\n            }\n        )\n        user = self.get_by_id(user_id)\n        return user\n\n    def delete(self, user_id):\n        """Delete a user"""\n        Books().delete_by_user_id(user_id)\n        user = db.users.delete_one({"_id": bson.ObjectId(user_id)})\n        user = self.get_by_id(user_id)\n        return user\n\n    def disable_account(self, user_id):\n        """Disable a user account"""\n        user = db.users.update_one(\n            {"_id": bson.ObjectId(user_id)},\n            {"$set": {"active": False}}\n        )\n        user = self.get_by_id(user_id)\n        return user\n\n    def encrypt_password(self, password):\n        """Encrypt password"""\n        return generate_password_hash(password)\n\n    def login(self, email, password):\n        """Login a user"""\n        user = self.get_by_email(email)\n        if not user or not check_password_hash(user["password"], password):\n            return\n        user.pop("password")\n        return user
\n

Here's an example of the user request:

\n
{\n     "name" : "abc xyz",\n     "email" : "xyz@gmail.com",\n     "password" : "Abc@123"\n}
\n

Here, the name should have two words, and the password should have at least an uppercase later, a lower case letter, a digit, and a special character.

\n

And an example of the book request:

\n
{\n    "title":"name of book",\n    "cover_image": "path to image file locally",\n    "category": "['romance', 'peotry', 'politics', 'picture book', 'science', 'fantasy', 'horror', 'thriller'],\n    "description":"description",\n    "user_id":"user_id"\n}
\n

While passing a book request, pass it via the form-data tab in Postman.

\n

Conclusion

\n

This article has explained flask JWT authentication .

\n

In some cases, handling flask authentication yourself may not be good enough or efficient -- to overcome this, you can simply use third-party authentication providers like LoginRadius. You can check out this tutorial to learn how to add LoginRadius to your Flask application.

\n

You can find the complete code for this article on Github. You can reach out to me on Twitter if you've any questions.

\n","headings":[{"value":"What is Authentication?","depth":2},{"value":"Authentication Factors","depth":2},{"value":"Single-factor Authentication","depth":3},{"value":"Multi-factor Authentication","depth":3},{"value":"Types of Authentication","depth":2},{"value":"Authentication vs. Authorization","depth":2},{"value":"Starter Application","depth":2},{"value":"Authentication Middleware","depth":2},{"value":"Auth Routes","depth":2},{"value":"Protecting API Routes in Flask","depth":2},{"value":"Conclusion","depth":2}],"fields":{"slug":"/engineering/guest-post/securing-flask-api-with-jwt/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":"This tutorial helps you build a simple Flask API and demonstrates how to secure it using JWT. In the end, you can test your API authentication using a sample schema.","title":"Using JWT Flask JWT Authentication- A Quick Guide","canonical":null,"date":"December 09, 2021","updated_date":null,"tags":["Flask","JWT","API"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/1cfc51c7d9ade423f3b1992809ba5b1b/2ad7f/coverImage.webp","srcSet":"/static/1cfc51c7d9ade423f3b1992809ba5b1b/1c9b5/coverImage.webp 200w,\n/static/1cfc51c7d9ade423f3b1992809ba5b1b/f1752/coverImage.webp 400w,\n/static/1cfc51c7d9ade423f3b1992809ba5b1b/2ad7f/coverImage.webp 800w,\n/static/1cfc51c7d9ade423f3b1992809ba5b1b/e7405/coverImage.webp 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Babatunde Koiki","github":"Babatunde13","bio":"He is an experienced software engineer with great passion for building reliable, scalable, and maintainable products. And he loves great documentation. When he is not writing code, he hangs out with friends or watches movies.","avatar":null}}}},"pageContext":{"id":"493661c3-a0e2-5195-aaa2-674b3eb14e67","fields__slug":"/engineering/guest-post/securing-flask-api-with-jwt/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}