Create authAPI.py

[Mohima6]

No description provided.

[Adez017]

Hi @Mohima6 , i think you had done pretty work but if you are contributing through GSSoC'25 . the ideal approach is first you need to create an issue and when the issue is assigned to you , then you can open an PR

[Mohima6]

hello, @Adez017 ; thanks for letting me know.

[indra7777]

Security Review - Request Changes

Thanks for contributing the authentication API module @Mohima6! This is indeed an important backend component. However, I've identified several critical security issues that must be addressed before approval:

🚨 Critical Security Issues

1. Hardcoded Secret Key (Line 10): SECRET_KEY = "your-secret-key" is a major vulnerability. This must be loaded from environment variables:

   import os
   SECRET_KEY = os.getenv("SECRET_KEY", "fallback-key-for-dev-only")

2. Missing Rate Limiting: Login/signup endpoints are vulnerable to brute force attacks. Consider adding rate limiting with slowapi or similar.

3. Weak Error Messages: Generic error messages can aid attackers. The login endpoint should return the same message for both "user not found" and "wrong password" scenarios.

📋 Additional Improvements Needed

4. Missing Input Validation: No validation for username/password requirements (length, complexity, etc.)

5. Missing Documentation: Add docstrings to all functions explaining parameters, return values, and usage.

6. Missing Unit Tests: Authentication logic should have comprehensive test coverage.

7. Database Transaction Safety: Consider adding proper error handling and rollback for database operations.

✅ What's Good

• Proper use of bcrypt for password hashing
• JWT implementation follows good practices
• Clean separation of concerns
• Proper FastAPI patterns

Recommendation: Please address the critical security issues (especially #1-3) before this can be approved for merge. The hardcoded secret key alone makes this unsuitable for any production environment.

Would you like to update the PR with these fixes?

[Mohima6]

sure @indra7777 . thanks for letting me know