Password Hashing and the Login Endpoint

Store passwords with a slow, salted hash: the FastAPI docs now use pwdlib with Argon2 (passlib is unmaintained). Implement login with OAuth2PasswordRequestForm (form fields username and password) so Swagger UI's "Authorize" button works. Return the same error for unknown users and wrong passwords, and rate-limit the endpoint.

from typing import Annotated
from fastapi import Depends, HTTPException, status
from fastapi.security import OAuth2PasswordRequestForm
from pwdlib import PasswordHash

password_hash = PasswordHash.recommended()     # Argon2


def hash_password(raw: str) -> str:
    return password_hash.hash(raw)


@app.post("/auth/token")
async def login(form: Annotated[OAuth2PasswordRequestForm, Depends()], db: DB) -> TokenOut:
    user = await users.by_email(db, form.username)
    if user is None or not password_hash.verify(form.password, user.password_hash):
        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Incorrect email or password",
                            headers={"WWW-Authenticate": "Bearer"})
    return TokenOut(access_token=create_access_token(user), token_type="bearer")

Common pitfalls

• Different errors for unknown email vs wrong password (account enumeration).
• Fast hashes like SHA-256 for passwords.
• No rate limiting on the login route.

Key points

• Argon2 via pwdlib
• OAuth2PasswordRequestForm for login
• Generic errors and rate limits

Further reading: FastAPI: OAuth2 with password and JWT