Acquiring current user in middleware

[Xevion]

I was interested in providing API-wide middleware to attribute an IP to a user in the background. I intended to use middleware.
But unfortunately, I got stuck when trying to actually access the user - dependency resolution, or whatever you want to call it, doesn't seem to work at all for FastAPI in middleware. This makes sense, but the bottom line is that I don't know how to proceed from here.

Here's a slightly simplified version of what I've got right now.

@app.middleware("http")
async def record_user_activity(request: Request, call_next):
    ip = request.client.host
    user = await current_user(redis='blah')
    response = await call_next(request)
    return response

And the logged exception...

ERROR:    Exception in ASGI application
Traceback (most recent call last):
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\uvicorn\protocols\http\h11_impl.py", line 404, in run_asgi
    result = await app(  # type: ignore[func-returns-value]
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\uvicorn\middleware\proxy_headers.py", line 78, in __call__
    return await self.app(scope, receive, send)
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\fastapi\applications.py", line 269, in __call__
    await super().__call__(scope, receive, send)
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\starlette\applications.py", line 124, in __call__
    await self.middleware_stack(scope, receive, send)
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\starlette\middleware\errors.py", line 184, in __call__
    raise exc
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\starlette\middleware\errors.py", line 162, in __call__
    await self.app(scope, receive, _send)
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\starlette\middleware\base.py", line 68, in __call__
    response = await self.dispatch_func(request, call_next)
  File "F:\Programming\Projects\motophoto\server\main.py", line 43, in record_user_activity
    user = await current_user(redis=request.cookies)
  File "<makefun-gen-7>", line 2, in current_user_dependency
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\fastapi_users\authentication\authenticator.py", line 136, in current_user_dependency
    user, _ = await self._authenticate(
  File "C:\Users\Xevion\.virtualenvs\motophoto-54a1Qt4r\lib\site-packages\fastapi_users\authentication\authenticator.py", line 170, in _authenticate
    user = await strategy.read_token(token, user_manager)
AttributeError: 'Depends' object has no attribute 'read_token'

[frankie567]

The current_user function is designed to work inside the dependency injection framework of FastAPI. It won't work outside it.

If you really need to retrieve the user in the middleware, you'll need to manually make the operations the DI system normally do:

1. Retrieve the token manually from the request, whether it's a cookie, an authorization header or whatever
2. Instantiate the UserManager manually, taking care of passing all needed arguments (see: https://fastapi-users.github.io/fastapi-users/10.1/cookbook/create-user-programmatically/#create-a-user-programmatically)
3. Call the read_token method with the token you retrieved

[Xevion]

That sounds like it might be kinda slow; would you know of good ways of attributing IPs to users automatically?

I currently don't know what methods are employed in existing FastAPI stacks...

[frankie567]

Well, a good solution could be to define a dependency and use it at global FastAPI level:

current_active_optional_user = fastapi_users.current_user(active=True, optional=True)

async def set_user_ip(
    request: Request,
    user: Optional[User] = Depends(current_active_optional_user),
    user_manager: UserManager = Depends(get_user_manager),
):
    if user is not None:
        ip = request.client.host
        user = await user_manager._update(user, {"ip": ip})   # Assuming you have a column `ip` on your user's model

app = FastAPI(dependencies=[Depends(set_user_ip)])  # Will be called on each request

[Xevion]

Crazy! Never would have thought you could use dependencies like that. Thanks for the example and though and everything - this is very helpful.

Here's what I ended up using in the end:

async def set_user_ip(request: Request, user: Optional[User] = Depends(current_active_optional_user),
                      session: AsyncSession = Depends(get_async_session)):
    yield None
    if user is not None:
        ip = request.client.host

        insert_statement = insert(TrackedUser).values(id=str(ip), user_id=user.id)
        on_duplicate_key_statement = insert_statement.on_conflict_do_update(
            index_elements=['id', 'user_id'],
            set_={'last_seen': datetime.utcnow()}
        )
        await session.execute(on_duplicate_key_statement)
        await session.commit()

Sorry if some of the SQLAlchemy usage seems a bit weird - I really don't have a lot of experience with it, but it works just fine.

If by chance you know of any performance considerations with code like this, I would LOVE to hear them. I followed this FastAPI guide on Dependencies with yield to understand how I could perhaps get the dependency to not be waited on before the request could be processed. I also used Postgres's ON CONFLICT DO UPDATE statement so only one statement get's processed in the background.

On my local server, the first request takes 45ms and drops down to 11-13ms for the /users/me route, with the database updating.

I didn't end up using the user_manager._update method, even though it's cool, but I may or may not end up using it as there's another field I have to update in combination. Depends on whether I can change multiple statements in a batch with SQLAlchemy.

[tim-habitat]

I think it would be really useful to have an off the shelf middleware that would either return attach current user to the request or None if no user is found.
fastapi-login provides it and i have found it super useful so far!