FastAPI Webapp via Dockerized Fief

[ScottFred]

I'm trying to get the FastAPI WebApp authentication working via a localized Fief authentication server. I am able to get this working when using the Fief Cloud, but fails when I try to use a self-hosted Fief server. Ultimately, I think there is something wrong with the relatively new python client, 0.18.2, but I haven't set it up to debug exactly what is wrong yet. But, I think it ends up trying to call my FastAPI server (running at localhost:8080) rather than the Fief Server (running at localhost:8000) when trying to call the /authenticate route.

When I enter the following URL in the browser: http://localhost:8080/protected, it looks like FastAPI sees the user is not authenticated, and redirects the HTTP connection (via 307 redirect) to the wrong server. It should be routed to my local Fief Authentication Server (http:localhost:8000/authenticate) to allow me to enter my credentials, but instead sends the redirect to the same FastAPI server.

Here's the log messages I see on my FastAPI server (the Fief authentication server, of course, sees no HTTP traffic since it is being sent here):

fastapi-app  | INFO:     Application shutdown complete.
fastapi-app  | INFO:     Finished server process [12]
fastapi-app  | INFO:     Started server process [15]
fastapi-app  | INFO:     Waiting for application startup.
fastapi-app  | INFO:     Application startup complete.
fastapi-app  | INFO:     192.168.224.1:47598 - "GET /home HTTP/1.1" 200 OK
fief-server  | 2023-11-27 00:03:11.285 | INFO     | uvicorn.protocols.http.httptools_impl:send:496 - 192.168.224.4:43702 - "GET /.well-known/openid-configuration HTTP/1.1" 200 - {}
fief-server  | 2023-11-27 00:03:11.305 | INFO     | uvicorn.protocols.http.httptools_impl:send:496 - 192.168.224.4:43708 - "GET /.well-known/jwks.json HTTP/1.1" 200 - {}
fastapi-app  | INFO:     192.168.224.1:47600 - "GET /protected HTTP/1.1" 307 Temporary Redirect
fastapi-app  | INFO:     192.168.224.1:47600 - "GET /authorize?response_type=code&client_id=e8hO4dBLuFlfFZX_IY1Vls9oLc0OwBSdCPFjIYNjirA&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fauth-callback&scope=openid HTTP/1.1" 404 Not Found

Here's my configuration:
.env

# Fief Environment Variables
FIEF_CLIENT_ID=<Client_ID>
PORT=8000
ROOT_DOMAIN=localhost:8000
FIEF_DOMAIN=localhost:8000
[email protected]
FIEF_SERVER_URL=http://localhost:8000
DATABASE_TYPE=SQLITE
REDIS_URL=redis://fief-redis:6379

# Fief Secrets
SECRET=<secret>
FIEF_CLIENT_SECRET=<secret>
ENCRYPTION_KEY=<encryption>
FIEF_MAIN_USER_PASSWORD=<password>

Dockerfile: (fastapi with webapp)

FROM python:3.11-bullseye

RUN apt-get update -y && \
  pip install --upgrade pip

WORKDIR /app
COPY app/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

ENV user appuser

RUN useradd -m -d /home/${user} ${user} \
  && chown -R ${user} /home/${user}

# set Python specific environment variables
# PYTHONDONTWRITEBYTECODE: Prevents Python from writing pyc files to disc (equivalent to python -B option)
ENV PYTHONDONTWRITEBYTECODE 1
# PYTHONUNBUFFERED: Prevents Python from buffering stdout and stderr (equivalent to python -u option)
ENV PYTHONUNBUFFERED 1

USER ${user}

# During local development, Docker Compose will mount the FastAPI source code into the container and
#   Uvicorn will identify changes to the code and reload the application wihtout having to build
#   a new Docker image for each FastAPI code change
# COPY app/ .

# Run FastAPI via Uvicorn
CMD uvicorn --host 0.0.0.0 --port 8080 app:app --reload

docker-compose.yml:

# https://docs.fief.dev/integrate/python/fastapi/#web-application-example

services:
   fief:
      container_name: fief-server
      image: ghcr.io/fief-dev/fief:0.27.0
      command: fief run-server --port 8000
      ports:
        - '8000:8000'
      env_file: .env
      depends_on:
        - redis

   redis:
      container_name: fief-redis
      image: redis:alpine
      command: redis-server --save 60 1 --loglevel warning

   fastapi:
      container_name: fastapi-app
      image: my-fastapi
      build:
        context: .
      volumes: # mount the FastAPI source code in the container
        - ./app:/app
      ports:
        - '8080:8080'
      env_file: .env
      depends_on:
        - fief

app/app.py

from fastapi import Depends, FastAPI, HTTPException, Query, Request, Response, status
from fastapi.responses import HTMLResponse, RedirectResponse
from fastapi.security import APIKeyCookie
from fief_client import FiefAsync, FiefUserInfo
from fief_client.integrations.fastapi import FiefAuth


class CustomFiefAuth(FiefAuth):
    client: FiefAsync

    async def get_unauthorized_response(self, request: Request, response: Response):
        redirect_uri = request.url_for("auth_callback")
        auth_url = await self.client.auth_url(redirect_uri, scope=["openid"])
        raise HTTPException(
            status_code=status.HTTP_307_TEMPORARY_REDIRECT,
            headers={"Location": str(auth_url)},
        )

#fief = FiefAsync(
#    "https://cai.fief.dev",
#    "zFZr5_rU1Jr_DB9gMQDldJgf_RfmTyWSmFp6cv8K9v8",
#    "UY8c_La2nAEYAx9WfdzMnW0FcYLhdXoLfwPJ5VgsUKc"
#)

fief = FiefAsync(
    "http://fief-server:8000",
    "e8hO4dBLuFlfFZX_IY1Vls9oLc0OwBSdCPFjIYNjirA",
    "UGfgw8xVJozYhdykdvm5Ngq5DYKGvlQYkXtuhzz0PqA",
    host="localhost:8000"
)

SESSION_COOKIE_NAME = "user_session"
scheme = APIKeyCookie(name=SESSION_COOKIE_NAME, auto_error=False)
auth = CustomFiefAuth(fief, scheme)

app = FastAPI()

@app.get("/auth-callback", name="auth_callback")
async def auth_callback(request: Request, response: Response, code: str = Query(...)):
    redirect_uri = request.url_for("auth_callback")
    tokens, _ = await fief.auth_callback(code, redirect_uri)

    response = RedirectResponse(request.url_for("protected"))
    response.set_cookie(
       SESSION_COOKIE_NAME,
       tokens["access_token"],
       max_age=tokens["expires_in"],
       httponly=True,
       secure=False
    )

    return response

@app.get("/protected", name="protected")
async def protected(
    user: FiefUserInfo = Depends(auth.current_user())
  ):

    return HTMLResponse(
        f"<h1> You are Authenticated. Your user email is {user['email']}</h1>"
    )

# Unprotected route
@app.get("/home")
async def home():
    return {"Welcome Home!"}

app/requirements.txt

fastapi==0.104.1
fief-client[fastapi]==0.18.2
psycopg2-binary==2.9.6
SQLAlchemy==2.0.7
uvicorn==0.24.0.post1

Dockerfile

FROM python:3.11-bullseye

RUN apt-get update -y && \
  pip install --upgrade pip

WORKDIR /app
COPY app/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

ENV user appuser

RUN useradd -m -d /home/${user} ${user} \
  && chown -R ${user} /home/${user}

# set Python specific environment variables
# PYTHONDONTWRITEBYTECODE: Prevents Python from writing pyc files to disc (equivalent to python -B option)
ENV PYTHONDONTWRITEBYTECODE 1
# PYTHONUNBUFFERED: Prevents Python from buffering stdout and stderr (equivalent to python -u option)
ENV PYTHONUNBUFFERED 1

USER ${user}

# During local development, Docker Compose will mount the FastAPI source code into the container and
#   Uvicorn will identify changes to the code and reload the application wihtout having to build
#   a new Docker image for each FastAPI code change
# COPY app/ .

# Run FastAPI via Uvicorn
CMD uvicorn --host 0.0.0.0 --port 8080 app:app --reload

[fief-bailiff[bot]]

Hail, @ScottFred 👋

I've noticed you shared secret values: FIEF_CLIENT_ID. Those are highly sensitive and you should keep them secret.

For your security, I've taken the liberty to replace them with dummy values.

[ScottFred]

Eh, Client ID is not as sensitive as the Client Secret.

[frankie567]

Yes, this is related to fief-dev/fief-python#14. Since it's (wrongly) returning relative URL for /authorize, it'll redirect you to the current server, i.e. your FastAPI app, instead of Fief.

I'll issue the fix ASAP.

[frankie567]

Should be fixed in https://github.com/fief-dev/fief-python/releases/tag/v0.18.3

[ScottFred]

Thanks @frankie567 ! This works! I didn't make the connection that the previous bug would cause this. Thanks for getting this fixed so quickly!