JWT token verification in FastAPI - Step-by-Step Execution

Concept Flow - JWT token verification

Receive HTTP request with JWT token

↓

Extract token from Authorization header

↓

Decode token using secret key

↓

Check token signature validity

↓

Check token expiry

↓

If expired?

↓

Reject

↓

Return response

This flow shows how a JWT token is extracted, decoded, verified for signature and expiry, then either accepted or rejected.

Execution Sample

FastAPI

from fastapi import FastAPI, Depends, HTTPException
from fastapi.security import HTTPBearer
import jwt

app = FastAPI()
security = HTTPBearer()

Setup FastAPI app and HTTPBearer security to extract JWT token from requests.

Execution Table

Step	Action	Input	Result	Next Step
1	Receive HTTP request	Authorization: Bearer <token>	Token extracted	Decode token
2	Decode token	<token>	Payload or error	Check signature validity
3	Check signature	Decoded payload	Valid or invalid	If invalid reject, else check expiry
4	Check expiry	Payload 'exp' field	Expired or valid	If expired reject, else allow
5	Allow access	Valid token	User info returned	Process request
6	Reject request	Invalid or expired token	HTTP 401 Unauthorized	End

💡 Execution stops when token is either accepted (valid and not expired) or rejected (invalid signature or expired)

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
token	None	<token string>	<decoded payload or error>	<valid or invalid>	<expired or valid>	Valid token or rejection
payload	None	None	{user_id, exp, ...}	{user_id, exp, ...}	{user_id, exp, ...}	User info or None

Key Moments - 3 Insights

Why do we check the token signature before expiry?

Because if the signature is invalid (see step 3 in execution_table), the token is tampered and should be rejected immediately without checking expiry.

What happens if the token is expired?

At step 4, if the 'exp' field shows the token is expired, the request is rejected with HTTP 401 Unauthorized (step 6).

Where do we get the token from in the HTTP request?

At step 1, the token is extracted from the Authorization header using HTTPBearer security scheme.

Visual Quiz - 3 Questions

Look at the execution_table, what happens at step 3 if the token signature is invalid?

A The token is rejected and request ends

B The token is accepted and request proceeds

C The expiry is checked next

D The token is decoded again

💡 Hint

Refer to step 3 in execution_table where invalid signature leads to rejection

At which step does the system check if the token is expired?

A Step 1

B Step 4

C Step 2

D Step 6

💡 Hint

Check execution_table row for step 4 about expiry check

If the token is valid and not expired, what is the final action?

A Reject request with 401

B Decode token again

C Return user info and allow access

D Extract token from header

💡 Hint

Look at step 5 in execution_table for valid token outcome

Concept Snapshot

JWT token verification in FastAPI:
- Extract token from Authorization header
- Decode token using secret key
- Verify signature validity
- Check token expiry
- Accept if valid and not expired
- Reject with 401 if invalid or expired

Full Transcript

This visual execution trace shows how FastAPI verifies a JWT token. First, the token is extracted from the Authorization header using HTTPBearer. Then the token is decoded using a secret key. The signature is checked to ensure the token is not tampered. If the signature is invalid, the request is rejected immediately. If valid, the token expiry time is checked. If expired, the request is rejected. If not expired, the user info from the token is returned and access is allowed. This step-by-step process ensures secure access control using JWT tokens.

Practice

1. What is the main purpose of JWT token verification in a FastAPI application?

easy

A. To check if the user token is valid and trusted

B. To encrypt the user's password

C. To store user data in the database

D. To generate HTML pages dynamically

Solution

1. Step 1: Understand JWT token role

   JWT tokens are used to prove a user's identity securely.

2. Step 2: Identify verification purpose

   Verification checks if the token is valid and trusted before allowing access.

3. Final Answer:

   To check if the user token is valid and trusted -> Option A

4. Quick Check:

   JWT verification = check token validity [OK]

Hint: JWT verification means confirming token is valid [OK]

Common Mistakes:

• Confusing verification with encryption
• Thinking JWT stores user data permanently
• Mixing token verification with UI rendering

2. Which FastAPI dependency is commonly used to extract and verify a JWT token from the request header?

easy

A. Depends()

B. Form()

C. RequestBody()

D. OAuth2PasswordBearer

Solution

1. Step 1: Identify FastAPI dependency for JWT

   OAuth2PasswordBearer is designed to extract bearer tokens from headers.

2. Step 2: Confirm usage for JWT verification

   This dependency helps get the token string to verify it in your code.

3. Final Answer:

   OAuth2PasswordBearer -> Option D

4. Quick Check:

   OAuth2PasswordBearer extracts JWT token [OK]

Hint: OAuth2PasswordBearer extracts token from header [OK]

Common Mistakes:

• Using Depends() alone without OAuth2PasswordBearer
• Confusing Form() with header token extraction
• Using RequestBody() which reads body, not headers

3. Given this FastAPI code snippet, what will happen if the JWT token is invalid?

async def get_current_user(token: str = Depends(oauth2_scheme)):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")
    return payload

medium

A. The function returns the payload even if token is invalid

B. The server crashes with an unhandled exception

C. An HTTP 401 error is raised with 'Invalid token' message

D. The token is ignored and user is treated as anonymous

Solution

1. Step 1: Analyze try-except block

   If jwt.decode fails, it raises JWTError which is caught by except.

2. Step 2: Check except block behavior

   It raises HTTPException with status 401 and message 'Invalid token'.

3. Final Answer:

   An HTTP 401 error is raised with 'Invalid token' message -> Option C

4. Quick Check:

   Invalid token triggers HTTP 401 error [OK]

Hint: Invalid JWT triggers HTTPException 401 [OK]

Common Mistakes:

• Assuming function returns payload on invalid token
• Thinking server crashes without handling error
• Believing token is ignored silently

4. Identify the error in this FastAPI JWT verification code:

from fastapi import Depends, HTTPException
from jose import jwt, JWTError

def verify_token(token: str):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
    except:
        HTTPException(status_code=401, detail="Invalid token")
    return payload

medium

A. HTTPException is raised but not returned or raised properly

B. Missing import for HTTPException

C. jwt.decode is called with wrong parameters

D. The function should not return payload

Solution

1. Step 1: Check exception handling

   HTTPException is created but not raised or returned, so error is ignored.

2. Step 2: Correct usage of HTTPException

   Must use 'raise HTTPException(...)' to properly stop execution and send error.

3. Final Answer:

   HTTPException is raised but not returned or raised properly -> Option A

4. Quick Check:

   Use 'raise' keyword with HTTPException [OK]

Hint: Always 'raise' HTTPException to trigger error [OK]

Common Mistakes:

• Forgetting 'raise' before HTTPException
• Catching too broad exceptions without logging
• Returning payload even on error

5. How can you protect a FastAPI route so that only requests with a valid JWT token can access it?

hard

A. Check the token manually inside the route function without dependencies

B. Use a dependency that verifies the JWT token and include it in the route

C. Add a middleware that ignores JWT tokens

D. Use a global variable to store token validity

Solution

1. Step 1: Understand FastAPI dependencies

   Dependencies can run code before route logic and reject invalid requests.

2. Step 2: Use dependency to verify JWT

   Including a JWT verification dependency ensures only valid tokens allow access.

3. Final Answer:

   Use a dependency that verifies the JWT token and include it in the route -> Option B

4. Quick Check:

   Dependency verifies JWT before route runs [OK]

Hint: Protect routes with JWT verification dependency [OK]

Common Mistakes:

• Checking token inside route instead of dependency
• Ignoring token verification in middleware
• Using global variables for token state