設定密碼保護你的 FastAPI Docs｜抬升 Raise

這篇文章要教你如何透過權限控管，保護 FastAPI 生成的 API 文件，讓使用者需要經過授權才能進去

1. 關閉預設 API Docs

from fastapi import FastAPI
app = FastAPI(docs_url=None, redoc_url=None, openapi_url = None)

2. 新增 HTTP Basic Auth 帳號密碼驗證

import secrets
from fastapi import Depends, FastAPI, HTTPException, status
from fastapi.security import HTTPBasic, HTTPBasicCredentials


security = HTTPBasic()

def get_current_username(credentials: HTTPBasicCredentials = Depends(security)):
    correct_username = secrets.compare_digest(credentials.username, "user")
    correct_password = secrets.compare_digest(credentials.password, "password")
    if not (correct_username and correct_password):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Basic"},
        )
    return credentials.username

3. 成立文件後台的 API 並加上驗證機制

from fastapi.openapi.docs import get_swagger_ui_html
from fastapi.openapi.utils import get_openapi

@app.get("/docs", include_in_schema=False)
async def get_documentation(username: str = Depends(get_current_username)):
    return get_swagger_ui_html(openapi_url="/openapi.json", title="docs")


@app.get("/openapi.json", include_in_schema=False)
async def openapi(username: str = Depends(get_current_username)):
    return get_openapi(title = "FastAPI", version="0.1.0", routes=app.routes)

4. 完成，運行服務並至 /docs 登入查看文件

完整程式碼