8 2 2 Handling Authentication Explained

2 2 Handling Authentication Explained

Key Concepts

Authentication: The process of verifying the identity of a user.
Session Management: Managing user sessions to maintain state across requests.
Password Hashing: Securely storing passwords using cryptographic functions.
OAuth: An open standard for access delegation.
JWT (JSON Web Tokens): A compact, URL-safe means of representing claims between two parties.

Authentication

Authentication is the process of verifying the identity of a user. This is typically done by requiring the user to provide credentials such as a username and password. Once authenticated, the user can access protected resources.

Session Management

Session management involves maintaining the state of a user's interaction with the application across multiple requests. This is typically done using session cookies or tokens. Streamlit provides built-in support for session state management.

Password Hashing

Password hashing is the process of securely storing passwords using cryptographic functions. This ensures that even if the database is compromised, the passwords cannot be easily retrieved. Common hashing algorithms include bcrypt and Argon2.

OAuth

OAuth is an open standard for access delegation. It allows users to grant third-party applications access to their resources without sharing their credentials. OAuth is commonly used for authentication with services like Google, Facebook, and GitHub.

JWT (JSON Web Tokens)

JWT is a compact, URL-safe means of representing claims between two parties. JWTs are often used for authentication and information exchange. They consist of three parts: a header, a payload, and a signature.

Examples

Example 1: Basic Authentication

import streamlit as st

def authenticate(username, password):
    return username == "admin" and password == "password"

username = st.text_input("Username")
password = st.text_input("Password", type="password")

if st.button("Login"):
    if authenticate(username, password):
        st.success("Logged in as {}".format(username))
    else:
        st.error("Invalid credentials")

Example 2: Session Management

import streamlit as st

if 'logged_in' not in st.session_state:
    st.session_state.logged_in = False

def login():
    st.session_state.logged_in = True

def logout():
    st.session_state.logged_in = False

if not st.session_state.logged_in:
    st.button("Login", on_click=login)
else:
    st.write("Welcome! You are logged in.")
    st.button("Logout", on_click=logout)

Example 3: Password Hashing

import bcrypt

def hash_password(password):
    salt = bcrypt.gensalt()
    hashed = bcrypt.hashpw(password.encode('utf-8'), salt)
    return hashed

def check_password(password, hashed):
    return bcrypt.checkpw(password.encode('utf-8'), hashed)

hashed_password = hash_password("my_password")
print(check_password("my_password", hashed_password))  # Output: True

Example 4: OAuth with Google

import streamlit as st
from google.oauth2 import service_account
from google.auth.transport.requests import Request

credentials = service_account.Credentials.from_service_account_file(
    'path/to/service-account-file.json',
    scopes=['https://www.googleapis.com/auth/drive'])

if credentials.expired:
    credentials.refresh(Request())

st.write("Authenticated with Google!")

Example 5: JWT Authentication

import jwt
import streamlit as st

secret_key = "your_secret_key"

def encode_jwt(payload):
    return jwt.encode(payload, secret_key, algorithm="HS256")

def decode_jwt(token):
    return jwt.decode(token, secret_key, algorithms=["HS256"])

token = encode_jwt({"user_id": 123})
decoded = decode_jwt(token)
st.write(decoded)  # Output: {'user_id': 123}

Analogies

Think of authentication as a security guard at a building entrance, verifying the identity of each person entering. Session management is like a guest pass that allows the visitor to move freely within the building. Password hashing is like a safe that stores valuables securely, making them difficult to access even if the safe is broken into. OAuth is like a valet service that allows you to use your car without giving the valet your keys. JWT is like a digital passport that securely carries your identity information between different countries.

By mastering the handling of authentication in Streamlit, you can create secure and user-friendly applications that protect sensitive data and resources.