import base64
import hmac
import hashlib
import json
from typing import Optional
from fastapi import FastAPI, Form, Cookie, Body
from fastapi.responses import Response
app = FastAPI()
SECRET_KEY = "f6974803655d6825b481cb476818be35ec015d48d743bfe4a56a989d85bbc368"
PASSWORD_SALT = "ee8849520dacf49a68dbba523fea3cc704ef3b3dcd21cb1a7ba1a59a89a02d06"
def sign_data(data: str) -> str:
'''Возвращает подписанные данные data'''
return hmac.new(
SECRET_KEY.encode(),
msg=data.encode(),
digestmod=hashlib.sha256
).hexdigest().upper()
def get_username_from_signed_string(username_signed: str) -> Optional[str]:
username_base64, sign = username_signed.split(".")
username = base64.b64decode(username_base64.encode()).decode()
valid_sign = sign_data(username)
if hmac.compare_digest(valid_sign, sign):
return username
def verify_password(username: str, password: str) -> bool:
password_hash = hashlib.sha256( (password + PASSWORD_SALT).encode() )\
.hexdigest().lower()
stored_password_hash = users[username]["password"].lower()
return password_hash == stored_password_hash
users = {
"alexey@user.com": {
"name" : "Алексей",
"password" : "fc551e507987011145ed58a29dd324731c1b477f1446dafec62583642869fc10",
"balance" : 100_000
},
"petr@user.com": {
"name" : "Пётр",
"password" : "71d474a34ffe47000bbf243f906bbaf8ef4816568de3ba13a5326ea122fa1a31",
"balance" : 555_555
}
}
@app.get("/")
def index_page(username: Optional[str] = Cookie(default=None)):
with open('templates/login.html', 'r') as f:
login_page= f.read()
if not username:
return Response(login_page, media_type="text/html")
valid_username = get_username_from_signed_string(username)
if not valid_username:
response = Response(login_page, media_type="text/html")
response.delete_cookie(key="username")
return response
try:
user = users[valid_username]
except KeyError:
response = Response(login_page, media_type='text/html')
response.delete_cookie(key="username")
return response
return Response(
f"Привет, {users[valid_username]['name']}!<br / >"
f"Баланс: {users[valid_username]['balance']}",
media_type='text/html')
@app.post("/login")
def process_login_page(data: dict = Body(...)):
print('data is', data)
password = data["password"]
username = data["username"]
user = users.get(username)
if not user or not verify_password(username, password):
return Response(
json.dumps({
"success" : False,
"message" : "Я вас не знаю!"
}),
media_type="application/json")
response = Response(
json.dumps({
"success" : True,
"message" : f"Привет, {user['name']}! <br /> Баланс: {user['balance']}"
}),
media_type="application/json")
username_signed = base64.b64encode(username.encode()).decode() + "." + \
sign_data(username)
response.set_cookie(key='username', value=username_signed)
return response
в def process_login_page(data: dict = Body(...)):
почему то не парсится json в виде пароля и логина, не знаю в чем причина, в браузер ответ приходит ошибкой -
detail: [{loc: ["body"], msg: "value is not a valid dict", type: "type_error.dict"}]
Вот пример странички сайта:
<html>
<head>
<title>Личный кабинет</title>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<style type="text/css">
input {
display: block;
font-size: 18px;
padding: 15px;
margin-bottom: 10px;
outline: none;
border: 1px solid #ccc;
border-radius: 5px;
width: 100%;
}
form{
width: 90%;
min-width: 250px;
max-width: 350px;
}
body {
margin: 0; padding: 0;
width: 100%;
height: 100%;
display: flex;
flex-direction: column;
align-items: center;
background-color: ghostwhite;
}
.placeholder{
flex: 1;
}
</style>
<script type="text/javascript">
document.addEventListener("DOMContentLoaded", function(){
let btn = document.querySelector('input[type=submit]');
btn.addEventListener('click', async function(event){
event.preventDefault();
let username = document.querySelector('input[name=username]').value;
let password = document.querySelector('input[name=password]').value;
let response = await fetch("/login", {
method: "POST",
body: `{"username": "${username}", "password": "${password}"}`
//body: new FormData(document.querySelector('form'))
});
let response_json = await response.json();
console.log(response_json);
if (response_json.success){
let body = document.querySelector('body');
body.style.backgroundColor = "white";
body.style.display = "block";
body.innerHTML = response_json.message;
}
})
})
</script>
</head>
<body>
<div class="placeholder"></div>
<form method="POST" action="/login">
<input type="text" name="username" />
<input type="password" name="password" autocomplete="off"/>
<input type="submit" value="Войти" />
</form>
<div class="placeholder"></div>
</body>
</html>