https://github.com/officialpycasbin/sanic-authz
Sanic authorization middleware based on Casbin
https://github.com/officialpycasbin/sanic-authz
abac acl auth authorization authz casbin middleware plugin py pycasbin python rbac sanic
Last synced: 9 months ago
JSON representation
Sanic authorization middleware based on Casbin
- Host: GitHub
- URL: https://github.com/officialpycasbin/sanic-authz
- Owner: officialpycasbin
- License: apache-2.0
- Created: 2025-06-04T15:48:55.000Z (about 1 year ago)
- Default Branch: master
- Last Pushed: 2025-09-16T15:45:57.000Z (9 months ago)
- Last Synced: 2025-09-16T18:08:16.788Z (9 months ago)
- Topics: abac, acl, auth, authorization, authz, casbin, middleware, plugin, py, pycasbin, python, rbac, sanic
- Language: Python
- Homepage: https://sanic.dev
- Size: 14.6 KB
- Stars: 2
- Watchers: 1
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# sanic-authz
[](https://github.com/officialpycasbin/sanic-authz/actions/workflows/build.yml)
[](https://coveralls.io/github/officialpycasbin/sanic-authz)
[](https://pypi.org/project/sanic-authz/)
[](https://pypi.org/project/sanic-authz/)
[](https://pypi.org/project/sanic-authz/)
[](https://pypi.org/project/sanic-authz/)
[](https://discord.gg/S5UjpzGZjN)
sanic-authz is an authorization middleware for [Sanic](https://sanic.dev/en/). It is based on [PyCasbin](https://github.com/casbin/pycasbin).
## Installation
```
pip install sanic-authz
```
## Module Usage:
```python
import casbin
from sanic import Sanic, response
from sanic.request import Request
from sanic_authz.middleware import CasbinAuthMiddleware
app = Sanic("SanicAuthzExample")
enforcer = casbin.Enforcer("rbac_model.conf", "policy.csv")
# Registration middleware
CasbinAuthMiddleware(sanic_app, enforcer)
# CasbinAuthMiddleware is a global middleware.
# The authorization check will be performed automatically on each request.
# You don't need to manually invoke the middleware in your route handlers.
@app.route("/")
async def homepage(request):
return response.text("Hello, world!")
```
Custom subject_getter:
By default, the middleware extracts user identity from the `X-User` header field. Client requests need to include the X-User header:
```
curl -H "X-User: alice" http://localhost:8000/data
```
You can customize the subject_getter to adapt to different authentication mechanisms. For example, JWT authentication:
```python
def jwt_subject_getter(request: Request) -> str:
token = request.headers.get("Authorization", "").replace("Bearer ", "")
payload = decode_jwt(token)
return payload.get("user_id", "anonymous")
CasbinAuthMiddleware(app, enforcer, subject_getter=jwt_subject_getter)
```
session authentication:
```python
def session_subject_getter(request: Request) -> str:
return request.ctx.session.get("user_id", "anonymous")
CasbinAuthMiddleware(app, enforcer, subject_getter=session_subject_getter)
```
## Documentation
The authorization determines a request based on ``{subject, object, action}``, which means what ``subject`` can perform what ``action`` on what ``object``. In this plugin, the meanings are:
1. ``subject``: the logged-in user name
2. ``object``: the URL path for the web resource like "dataset1/item1"
3. ``action``: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"
For how to write authorization policy and other details, please refer to [the PyCasbin's documentation](https://github.com/casbin/pycasbin).
### Getting Help
- [PyCasbin](https://github.com/casbin/pycasbin)
### License
This project is licensed under the [Apache 2.0 license](LICENSE).