Yapay zeka modellerini servis etmek, g\u00fcn\u00fcm\u00fcz\u00fcn en heyecan verici ve bir o kadar da kritik g\u00f6revlerinden biridir. Ancak bu modellerin sundu\u011fu API’lar, genellikle hassas verilerle etkile\u015fime girer veya kritik i\u015flevleri yerine getirir. Peki, bu de\u011ferli API’lar\u0131 yetkisiz eri\u015fimden nas\u0131l koruyabiliriz? \u0130\u015fte bu noktada, FastAPI’nin sundu\u011fu kolayl\u0131klar ve JSON Web Token (JWT) tabanl\u0131 kimlik do\u011frulama mekanizmas\u0131 devreye giriyor. Bu makalede, yapay zeka m\u00fchendislerinin FastAPI uygulamalar\u0131nda JWT kullanarak g\u00fcvenli ve \u00f6l\u00e7eklenebilir kimlik do\u011frulama sistemlerini nas\u0131l kuracaklar\u0131n\u0131 ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n
G\u00fcn\u00fcm\u00fczde yapay zeka (YZ) destekli uygulamalar, finans, sa\u011fl\u0131k, e\u011fitim ve otonom sistemler gibi pek \u00e7ok alanda kritik roller \u00fcstlenmektedir. Bu uygulamalar\u0131n temelini olu\u015fturan YZ API’lar\u0131, genellikle ki\u015fisel veriler, finansal bilgiler veya fikri m\u00fclkiyet de\u011feri y\u00fcksek algoritmalar gibi hassas bilgilere eri\u015fim sa\u011flar veya bu bilgileri i\u015fler. Dolay\u0131s\u0131yla, bu API’lar\u0131n g\u00fcvenli\u011fi, sadece teknik bir gereklilik olmaktan \u00f6te, yasal uyumluluk (KVKK, GDPR gibi), itibar koruma ve i\u015f s\u00fcreklili\u011fi a\u00e7\u0131s\u0131ndan hayati bir \u00f6nem ta\u015f\u0131r. Yetkisiz eri\u015fim, veri ihlallerine, hizmet kesintilerine, doland\u0131r\u0131c\u0131l\u0131\u011fa ve ciddi mali kay\u0131plara yol a\u00e7abilir. \u00d6rne\u011fin, bir sa\u011fl\u0131k uygulamas\u0131ndaki YZ te\u015fhis API’s\u0131na yetkisiz eri\u015fim, hastalar\u0131n \u00f6zel bilgilerinin s\u0131zd\u0131r\u0131lmas\u0131na veya yanl\u0131\u015f te\u015fhislerin manip\u00fcle edilmesine neden olabilir. Benzer \u015fekilde, bir finansal doland\u0131r\u0131c\u0131l\u0131k tespit modelinin API’s\u0131na yap\u0131lan yetkisiz m\u00fcdahale, sistemin zafiyetlerini ortaya \u00e7\u0131kararak b\u00fcy\u00fck \u00f6l\u00e7ekli finansal kay\u0131plara yol a\u00e7abilir. Bu senaryolar, API g\u00fcvenli\u011finin sadece “olmas\u0131 gereken” bir \u00f6zellik de\u011fil, ayn\u0131 zamanda “olmak zorunda olan” temel bir bile\u015fen oldu\u011funu a\u00e7\u0131k\u00e7a g\u00f6stermektedir. Bu ba\u011flamda, kimlik do\u011frulama (authentication) ve yetkilendirme (authorization) mekanizmalar\u0131, API g\u00fcvenli\u011finin temel ta\u015flar\u0131n\u0131 olu\u015fturur.<\/p>\n
Peki, bu kimlik do\u011frulama s\u00fcrecini nas\u0131l daha etkili ve g\u00fcvenli hale getirebiliriz? \u0130\u015fte burada JSON Web Token (JWT) devreye giriyor. JWT, istemciler ve sunucular aras\u0131nda g\u00fcvenli bir \u015fekilde bilgi al\u0131\u015fveri\u015fi yapmak i\u00e7in kullan\u0131lan kompakt, URL g\u00fcvenli bir y\u00f6ntemdir. Temelde bir JSON nesnesi olan JWT, dijital olarak imzalanm\u0131\u015f oldu\u011fu i\u00e7in i\u00e7eri\u011finin de\u011fi\u015ftirilmedi\u011fi ve g\u00f6nderenin kimli\u011finin do\u011fruland\u0131\u011f\u0131 garanti edilir. JWT’ler, \u00f6zellikle mikroservis mimarilerinde ve durum bilgisi olmayan (stateless) API’larda pop\u00fcler bir se\u00e7imdir \u00e7\u00fcnk\u00fc sunucunun her istekte kullan\u0131c\u0131 oturum bilgilerini saklamas\u0131na gerek kalmaz. Bu da sunucu taraf\u0131ndaki y\u00fck\u00fc azalt\u0131r ve yatay \u00f6l\u00e7eklenebilirli\u011fi art\u0131r\u0131r.<\/p>\n
Bir JWT, \u00fc\u00e7 ana b\u00f6l\u00fcmden olu\u015fur: Header (Ba\u015fl\u0131k), Payload (Y\u00fck) ve Signature (\u0130mza). Her bir b\u00f6l\u00fcm, base64url format\u0131nda kodlan\u0131r ve noktalarla ayr\u0131l\u0131r.<\/p>\n
JWT’nin \u00e7al\u0131\u015fma prensibi olduk\u00e7a basittir: Kullan\u0131c\u0131 kimlik bilgileriyle (kullan\u0131c\u0131 ad\u0131, parola) giri\u015f yapt\u0131\u011f\u0131nda, sunucu bu bilgileri do\u011frular ve ba\u015far\u0131l\u0131 olursa bir JWT olu\u015fturur. Bu token, istemciye g\u00f6nderilir ve istemci, sonraki her istekte bu token’\u0131 yetkilendirme ba\u015fl\u0131\u011f\u0131nda ( FastAPI, modern, h\u0131zl\u0131 (y\u00fcksek performansl\u0131), web API’lar\u0131 olu\u015fturmak i\u00e7in Python tabanl\u0131 bir framework (yaz\u0131l\u0131m \u00e7er\u00e7evesidir). Asenkron programlama deste\u011fi, otomatik dok\u00fcmantasyon (OpenAPI\/Swagger UI) ve ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu (Dependency Injection) gibi \u00f6zellikleriyle yapay zeka m\u00fchendisleri i\u00e7in API geli\u015ftirmeyi olduk\u00e7a kolayla\u015ft\u0131r\u0131r. JWT tabanl\u0131 kimlik do\u011frulama sistemini FastAPI ile entegre etmek i\u00e7in \u00f6ncelikle gerekli k\u00fct\u00fcphaneleri kurmam\u0131z ve temel bir yap\u0131land\u0131rma olu\u015fturmam\u0131z gerekmektedir. Bu b\u00f6l\u00fcmde, projemizi s\u0131f\u0131rdan olu\u015fturacak, gerekli paketleri kuracak ve kimlik do\u011frulama s\u00fcrecinin temelini atacak ilk ad\u0131mlar\u0131 ataca\u011f\u0131z.<\/p>\n FastAPI projemizi ba\u015flatmak i\u00e7in bir sanal ortam olu\u015fturmak iyi bir pratiktir. Bu, projemizin ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 sistem genelindeki Python paketlerinden izole etmemizi sa\u011flar. Ard\u0131ndan, FastAPI’nin kendisi, bir ASGI sunucusu olan Uvicorn, JWT olu\u015fturma ve do\u011frulama i\u00e7in Bu komutlar\u0131 \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, projemizin temel ba\u011f\u0131ml\u0131l\u0131klar\u0131 y\u00fcklenmi\u015f olacakt\u0131r. \u015eimdi, bu paketleri kullanarak bir FastAPI uygulamas\u0131 olu\u015fturmaya ba\u015flayabiliriz.<\/p>\n Projemiz i\u00e7in bir \u00d6ncelikle Kimlik do\u011frulama sistemi i\u00e7in kullan\u0131c\u0131 verilerini temsil edecek Pydantic modellerine ihtiyac\u0131m\u0131z var. Ayr\u0131ca, kullan\u0131c\u0131 parolalar\u0131n\u0131 d\u00fcz metin olarak saklamak yerine, g\u00fcvenli bir \u015fekilde hash’lememiz (kriptografik \u00f6zetleme) gerekir. Yukar\u0131daki kod blo\u011funda, FastAPI ile JWT tabanl\u0131 kimlik do\u011frulaman\u0131n temelini att\u0131ktan sonra, \u015fimdi kullan\u0131c\u0131lar\u0131n sisteme giri\u015f yapmas\u0131n\u0131 ve ba\u015far\u0131l\u0131 bir kimlik do\u011frulamas\u0131n\u0131n ard\u0131ndan JWT token’lar\u0131 almas\u0131n\u0131 sa\u011flayacak mekanizmalar\u0131 in\u015fa edelim. Bu s\u00fcre\u00e7, kullan\u0131c\u0131n\u0131n kimlik bilgilerini do\u011frulama, JWT olu\u015fturma ve bu token’\u0131 istemciye g\u00fcvenli bir \u015fekilde iletme ad\u0131mlar\u0131n\u0131 i\u00e7erir. FastAPI’nin ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu (Dependency Injection) sistemi, bu s\u00fcreci olduk\u00e7a mod\u00fcler ve y\u00f6netilebilir hale getirecektir.<\/p>\n \u0130lk olarak, JWT olu\u015fturmak i\u00e7in bir yard\u0131mc\u0131 fonksiyona ihtiyac\u0131m\u0131z var. Bu fonksiyon, kullan\u0131c\u0131n\u0131n kimli\u011fini ve token’\u0131n ge\u00e7erlilik s\u00fcresini i\u00e7eren bir payload alacak ve bu payload’\u0131 Bu fonksiyon, token’\u0131n payload’\u0131na \u015eimdi, kullan\u0131c\u0131lar\u0131n kimlik bilgilerini (kullan\u0131c\u0131 ad\u0131 ve parola) g\u00f6ndererek bir access token alabilecekleri bir giri\u015f endpoint’i olu\u015ftural\u0131m. FastAPI, Bu Art\u0131k kullan\u0131c\u0131lar token alabiliyor, ancak bu token’lar\u0131 korumal\u0131 rotalarda nas\u0131l kullanacaklar? FastAPI’nin ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu sistemi, gelen iste\u011fin yetkilendirme ba\u015fl\u0131\u011f\u0131ndaki JWT’yi al\u0131p do\u011frulayacak bir fonksiyon olu\u015fturmam\u0131za olanak tan\u0131r. Bu fonksiyon, her korumal\u0131 endpoint’e kolayca eklenebilir.<\/p>\n FastAPI’de JWT kimlik do\u011frulama mekanizmas\u0131n\u0131 ba\u015far\u0131yla kurduktan sonra, s\u0131ra geldi yapay zeka servislerimizi ve di\u011fer hassas rotalar\u0131m\u0131z\u0131 bu mekanizma ile koruma alt\u0131na almaya. Bu, sadece yetkili kullan\u0131c\u0131lar\u0131n veya sistemlerin YZ modellerimize eri\u015febilmesini ve onlarla etkile\u015fim kurabilmesini sa\u011flayarak veri g\u00fcvenli\u011fini ve model b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc garanti alt\u0131na al\u0131r. FastAPI’nin ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu sistemi sayesinde, bu koruma katman\u0131n\u0131 uygulamak olduk\u00e7a basittir ve kod tekrar\u0131n\u0131 minimize eder.<\/p>\n Daha \u00f6nce tan\u0131mlad\u0131\u011f\u0131m\u0131z Bir bankan\u0131n veya finansal kurumun, ger\u00e7ek zamanl\u0131 i\u015flem verilerini analiz ederek doland\u0131r\u0131c\u0131l\u0131k faaliyetlerini tespit eden bir YZ modeli geli\u015ftirdi\u011fini varsayal\u0131m. Bu modelin API’s\u0131, saniyede binlerce finansal i\u015flemi i\u015fleyebilir. Bu API’ya yetkisiz eri\u015fim, hem m\u00fc\u015fteri verilerinin if\u015fa olmas\u0131na hem de bankan\u0131n b\u00fcy\u00fck finansal kay\u0131plar ya\u015famas\u0131na neden olabilir. \u0130\u015fte bu senaryoda JWT kimlik do\u011frulama hayati bir rol oynar:<\/p>\n Bu t\u00fcr bir senaryoda, FastAPI’nin sundu\u011fu basit ve g\u00fc\u00e7l\u00fc ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu mekanizmas\u0131, hem geli\u015ftirme h\u0131z\u0131n\u0131 art\u0131r\u0131r hem de sa\u011flam bir g\u00fcvenlik katman\u0131 sa\u011flar. YZ m\u00fchendisleri, model geli\u015ftirme ve optimizasyonuna odaklan\u0131rken, API’lar\u0131n\u0131n arkas\u0131ndaki g\u00fcvenlik altyap\u0131s\u0131n\u0131n FastAPI ve JWT ile g\u00fcvenilir bir \u015fekilde sa\u011fland\u0131\u011f\u0131ndan emin olabilirler. Bu, YZ \u00fcr\u00fcnlerinin pazara daha h\u0131zl\u0131 ve daha g\u00fcvenli bir \u015fekilde sunulmas\u0131na olanak tan\u0131r.<\/p>\n FastAPI ve JWT ile temel kimlik do\u011frulama sistemini kurduk. Ancak ger\u00e7ek d\u00fcnya uygulamalar\u0131nda, \u00f6zellikle y\u00fcksek g\u00fcvenlik gerektiren veya b\u00fcy\u00fck \u00f6l\u00e7ekli yapay zeka servislerinde, daha geli\u015fmi\u015f senaryolar ve ek g\u00fcvenlik \u00f6nlemleri gerekebilir. Bu b\u00f6l\u00fcmde, token yenileme mekanizmalar\u0131, rol tabanl\u0131 eri\u015fim kontrol\u00fc (RBAC) ve di\u011fer \u00f6nemli g\u00fcvenlik ipu\u00e7lar\u0131n\u0131 inceleyece\u011fiz.<\/p>\n Eri\u015fim token’lar\u0131n\u0131n (access token) k\u0131sa \u00f6m\u00fcrl\u00fc olmas\u0131 (\u00f6rne\u011fin, 30 dakika) iyi bir g\u00fcvenlik uygulamas\u0131d\u0131r, \u00e7\u00fcnk\u00fc \u00e7al\u0131nmas\u0131 durumunda yetkisiz eri\u015fim s\u00fcresini s\u0131n\u0131rlar. Ancak bu, kullan\u0131c\u0131lar\u0131n s\u0131k s\u0131k yeniden giri\u015f yapmas\u0131 gerekti\u011fi anlam\u0131na gelir ki bu da kullan\u0131c\u0131 deneyimini olumsuz etkiler. Bu sorunu \u00e7\u00f6zmek i\u00e7in “refresh token” (yenileme token’\u0131) mekanizmas\u0131 kullan\u0131l\u0131r.<\/p>\n Bir kullan\u0131c\u0131 giri\u015f yapt\u0131\u011f\u0131nda, hem bir eri\u015fim token’\u0131 hem de bir yenileme token’\u0131 al\u0131r. Eri\u015fim token’\u0131 s\u00fcresi doldu\u011funda, istemci yenileme token’\u0131n\u0131 kullanarak \u00f6zel bir \u00c7o\u011fu YZ uygulamas\u0131nda, farkl\u0131 kullan\u0131c\u0131lar\u0131n veya sistemlerin farkl\u0131 yetki seviyelerine sahip olmas\u0131 gerekir. \u00d6rne\u011fin, bir y\u00f6netici kullan\u0131c\u0131s\u0131 YZ modelini g\u00fcncelleyebilirken, s\u0131radan bir kullan\u0131c\u0131 sadece tahmin servisini kullanabilir. JWT payload’\u0131na kullan\u0131c\u0131 rollerini ekleyerek ve bu rolleri korumal\u0131 rotalarda kontrol ederek RBAC’yi uygulayabiliriz.<\/p>\n Bu ileri d\u00fczey konular ve g\u00fcvenlik ipu\u00e7lar\u0131, yapay zeka m\u00fchendislerinin sadece \u00e7al\u0131\u015fan de\u011fil, ayn\u0131 zamanda g\u00fcvenli ve sa\u011flam API’lar geli\u015ftirmesine olanak tan\u0131r. \u00d6zellikle hassas verilerle \u00e7al\u0131\u015fan YZ modelleri i\u00e7in bu t\u00fcr \u00f6nlemler vazge\u00e7ilmezdir. Her bir ad\u0131m\u0131 dikkatle uygulamak, uygulaman\u0131z\u0131n genel g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirecektir.<\/p>\n Bu makalede, yapay zeka m\u00fchendisleri i\u00e7in FastAPI kullanarak JWT (JSON Web Token) tabanl\u0131 kimlik do\u011frulama sistemlerinin nas\u0131l kurulaca\u011f\u0131n\u0131 ve y\u00f6netilece\u011fini ayr\u0131nt\u0131l\u0131 bir \u015fekilde inceledik. API g\u00fcvenli\u011finin neden bu kadar kritik oldu\u011funu, JWT’nin temel yap\u0131s\u0131n\u0131 ve \u00e7al\u0131\u015fma prensiplerini anlad\u0131k. Ard\u0131ndan, FastAPI ortam\u0131n\u0131n kurulumundan ba\u015flayarak, kullan\u0131c\u0131 modellerinin olu\u015fturulmas\u0131, parolalar\u0131n g\u00fcvenli bir \u015fekilde hash’lenmesi, JWT olu\u015fturma ve do\u011frulama s\u00fcre\u00e7leri ile korumal\u0131 rotalar\u0131n nas\u0131l tan\u0131mlanaca\u011f\u0131n\u0131 ad\u0131m ad\u0131m uygulad\u0131k. Ger\u00e7ek d\u00fcnya senaryolar\u0131 \u00fczerinden, \u00f6zellikle finansal doland\u0131r\u0131c\u0131l\u0131k tespiti gibi hassas YZ servislerinde JWT’nin sa\u011flad\u0131\u011f\u0131 avantajlar\u0131 g\u00f6rd\u00fck. Son olarak, token yenileme mekanizmalar\u0131, rol tabanl\u0131 eri\u015fim kontrol\u00fc (RBAC) ve di\u011fer \u00f6nemli g\u00fcvenlik ipu\u00e7lar\u0131 ile ileri d\u00fczey konulara de\u011findik.<\/p>\n FastAPI’nin modern mimarisi ve ba\u011f\u0131ml\u0131l\u0131k enjeksiyonu sistemi, JWT entegrasyonunu olduk\u00e7a kolay ve mod\u00fcler hale getirerek geli\u015ftiricilerin i\u015f y\u00fck\u00fcn\u00fc \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r. YZ m\u00fchendisleri, bu g\u00fc\u00e7l\u00fc kombinasyonu kullanarak, modellerini g\u00fcvenli, \u00f6l\u00e7eklenebilir ve y\u00fcksek performansl\u0131 API’lar arac\u0131l\u0131\u011f\u0131yla sunabilirler. Unutulmamal\u0131d\u0131r ki, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve en iyi uygulamalar\u0131 takip etmek, API’lar\u0131n\u0131z\u0131n ve dolay\u0131s\u0131yla YZ modellerinizin uzun vadeli ba\u015far\u0131s\u0131 i\u00e7in vazge\u00e7ilmezdir.<\/p>\n Se\u00e7im, uygulaman\u0131z\u0131n mimarisine ve gereksinimlerine ba\u011fl\u0131d\u0131r. JWT, durum bilgisi olmayan (stateless) yap\u0131s\u0131 sayesinde mikroservis mimarileri ve mobil uygulamalar i\u00e7in daha uygundur, \u00e7\u00fcnk\u00fc sunucu taraf\u0131nda oturum bilgisi tutmaya gerek kalmaz, bu da \u00f6l\u00e7eklenebilirli\u011fi art\u0131r\u0131r. Session tabanl\u0131 kimlik do\u011frulama ise genellikle geleneksel monolitik web uygulamalar\u0131nda kullan\u0131l\u0131r ve sunucu taraf\u0131nda oturum bilgilerini saklar. YZ API’lar\u0131 genellikle durum bilgisi olmad\u0131\u011f\u0131 ve yatay \u00f6l\u00e7eklenebilirlik gerektirdi\u011fi i\u00e7in JWT daha avantajl\u0131d\u0131r.<\/p>\n<\/li>\n Eri\u015fim token’lar\u0131 genellikle istemci taraf\u0131nda (taray\u0131c\u0131da localStorage veya sessionStorage, mobil uygulamalarda g\u00fcvenli depolama alanlar\u0131) saklan\u0131r. Ancak XSS (Cross-Site Scripting) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 daha g\u00fcvenli olmas\u0131 i\u00e7in refresh token’lar HTTP-only cookie’ler i\u00e7inde saklanmal\u0131d\u0131r. Bu cookie’lere JavaScript ile eri\u015filemez, bu da XSS sald\u0131rganlar\u0131n\u0131n token’\u0131 ele ge\u00e7irmesini zorla\u015ft\u0131r\u0131r. Her iki durumda da token’lar\u0131n \u00e7al\u0131nma riskini azaltmak i\u00e7in k\u0131sa \u00f6m\u00fcrl\u00fc olmalar\u0131 \u00f6nemlidir.<\/p>\n<\/li>\n Eri\u015fim token’\u0131n\u0131n s\u00fcresi doldu\u011funda, istemci bu token ile korumal\u0131 bir rotaya istek g\u00f6nderdi\u011finde sunucu 401 Yetkisiz (Unauthorized) hatas\u0131 d\u00f6nd\u00fcrecektir. Bu durumda istemci, e\u011fer varsa, yenileme token’\u0131n\u0131 kullanarak yeni bir eri\u015fim token’\u0131 talep etmelidir. E\u011fer yenileme token’\u0131 da yoksa veya s\u00fcresi dolmu\u015fsa, kullan\u0131c\u0131n\u0131n yeniden giri\u015f yapmas\u0131 gerekir.<\/p>\n<\/li>\n Rol tabanl\u0131 yetkilendirme, kullan\u0131c\u0131n\u0131n rollerini JWT’nin payload k\u0131sm\u0131na ekleyerek yap\u0131l\u0131r (\u00f6rne\u011fin, Refresh token’lar, eri\u015fim token’lar\u0131n\u0131n k\u0131sa \u00f6m\u00fcrl\u00fc olmas\u0131n\u0131n getirdi\u011fi kullan\u0131c\u0131 deneyimi sorununu \u00e7\u00f6zmek i\u00e7in kullan\u0131l\u0131r. K\u0131sa \u00f6m\u00fcrl\u00fc eri\u015fim token’lar\u0131 g\u00fcvenlik a\u00e7\u0131s\u0131ndan daha iyidir \u00e7\u00fcnk\u00fc \u00e7al\u0131nmalar\u0131 durumunda yetkisiz eri\u015fim s\u00fcresini k\u0131s\u0131tlarlar. Refresh token’lar ise daha uzun \u00f6m\u00fcrl\u00fc olup, kullan\u0131c\u0131lar\u0131n s\u0131k s\u0131k yeniden giri\u015f yapmak zorunda kalmadan yeni eri\u015fim token’lar\u0131 almas\u0131n\u0131 sa\u011flar. Bu, hem g\u00fcvenli\u011fi hem de kullan\u0131c\u0131 deneyimini optimize eden bir yakla\u015f\u0131md\u0131r.<\/p>\n<\/li>\n<\/ul>\n #FastAPI #JWT #KimlikDo\u011frulama #YapayZeka #APIg\u00fcvenli\u011fi<\/p>\nAuthorization: Bearer <token><\/code>) sunucuya geri g\u00f6nderir. Sunucu, her istekte token’\u0131n imzas\u0131n\u0131 do\u011frular ve ge\u00e7erliyse, token’daki payload bilgilerini kullanarak kullan\u0131c\u0131n\u0131n yetkisini kontrol eder. Bu sayede, sunucu her istek i\u00e7in veritaban\u0131na sorgu yapmaktan veya oturum y\u00f6netimi i\u00e7in ek kaynaklar ay\u0131rmaktan kurtulur, bu da \u00f6zellikle y\u00fcksek trafikli YZ API’lar\u0131 i\u00e7in b\u00fcy\u00fck bir performans avantaj\u0131 sa\u011flar.<\/p>\nFastAPI ile JWT Kimlik Do\u011frulama Ortam\u0131n\u0131n Kurulumu ve Temel Yap\u0131land\u0131rma<\/h2>\n
Gerekli Paketlerin Kurulumu<\/h3>\n
python-jose<\/code> k\u00fct\u00fcphanesi ve parolalar\u0131 g\u00fcvenli bir \u015fekilde hash’lemek i\u00e7in passlib<\/code> paketini kurmam\u0131z gerekecek. bcrypt<\/code>, passlib<\/code>‘in g\u00fc\u00e7l\u00fc bir hash algoritmas\u0131d\u0131r ve parola g\u00fcvenli\u011fi i\u00e7in \u015fiddetle tavsiye edilir.<\/p>\n\n# Sanal ortam olu\u015fturma (iste\u011fe ba\u011fl\u0131 ama \u00f6nerilir)\npython -m venv venv\nsource venv\/bin\/activate # Linux\/macOS\n# venv\\Scripts\\activate # Windows\n\n# Gerekli paketleri kurma\npip install fastapi uvicorn python-jose passlib[bcrypt]\n <\/code><\/pre>\n<\/p><\/div>\nTemel FastAPI Uygulama Yap\u0131s\u0131 ve Ayarlar<\/h3>\n
main.py<\/code> dosyas\u0131 olu\u015ftural\u0131m. Bu dosya, FastAPI uygulamas\u0131n\u0131n ana giri\u015f noktas\u0131 olacakt\u0131r. Ayr\u0131ca, g\u00fcvenlik anahtarlar\u0131 ve token s\u00fcreleri gibi yap\u0131land\u0131rma ayarlar\u0131n\u0131 y\u00f6netmek i\u00e7in ayr\u0131 bir config.py<\/code> dosyas\u0131 olu\u015fturmak, kodumuzu daha d\u00fczenli ve g\u00fcvenli hale getirecektir.<\/p>\nconfig.py<\/code> dosyas\u0131n\u0131 olu\u015ftural\u0131m:<\/p>\n\n# config.py\nimport os\n\n# G\u00fcvenlik anahtar\u0131: JWT'leri imzalamak ve do\u011frulamak i\u00e7in kullan\u0131l\u0131r.\n# Ger\u00e7ek uygulamalarda bu de\u011feri bir ortam de\u011fi\u015fkeninden almal\u0131s\u0131n\u0131z.\nSECRET_KEY = os.getenv(\"SECRET_KEY\", \"gizli_anahtar_buraya_gelmeli_ve_cok_uzun_olmal\u0131\")\nALGORITHM = \"HS256\" # JWT imzalama algoritmas\u0131\nACCESS_TOKEN_EXPIRE_MINUTES = 30 # Eri\u015fim token'\u0131n\u0131n ge\u00e7erlilik s\u00fcresi (dakika)\nREFRESH_TOKEN_EXPIRE_DAYS = 7 # Yenileme token'\u0131n\u0131n ge\u00e7erlilik s\u00fcresi (g\u00fcn)\n <\/code><\/pre>\n<\/p><\/div>\nSECRET_KEY<\/code> de\u011feri, kesinlikle tahmin edilemez ve uzun olmal\u0131d\u0131r. \u00dcretim ortam\u0131nda bu de\u011feri do\u011frudan koda g\u00f6mmek yerine, ortam de\u011fi\u015fkenlerinden (environment variables) al\u0131nmas\u0131 kritik bir g\u00fcvenlik uygulamas\u0131d\u0131r. \u00d6rne\u011fin, Docker kullan\u0131yorsan\u0131z docker-compose.yml<\/code> dosyas\u0131nda veya Kubernetes kullan\u0131yorsan\u0131z Secret objeleri arac\u0131l\u0131\u011f\u0131yla bu anahtar\u0131 y\u00f6netebilirsiniz.<\/p>\nKullan\u0131c\u0131 Modelleri ve \u015eifreleme<\/h3>\n
passlib<\/code> k\u00fct\u00fcphanesi bu konuda bize yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n\n# main.py veya ayr\u0131 bir models.py dosyas\u0131\nfrom pydantic import BaseModel\nfrom typing import Optional\nfrom passlib.context import CryptContext\n\n# \u015eifre ba\u011flam\u0131 olu\u015fturma\n# bcrypt, g\u00fc\u00e7l\u00fc bir parola hash algoritmas\u0131d\u0131r.\npwd_context = CryptContext(schemes=[\"bcrypt\"], deprecated=\"auto\")\n\nclass User(BaseModel):\n username: str\n email: Optional[str] = None\n full_name: Optional[str] = None\n disabled: Optional[bool] = False\n hashed_password: str # Hashlenmi\u015f parola\n\nclass UserInDB(User):\n pass # Veritaban\u0131ndaki kullan\u0131c\u0131 modelimiz, User ile ayn\u0131 olabilir\n\nclass Token(BaseModel):\n access_token: str\n token_type: str\n\nclass TokenData(BaseModel):\n username: Optional[str] = None\n\n# Parola hashleme ve do\u011frulama fonksiyonlar\u0131\ndef get_password_hash(password: str) -> str:\n return pwd_context.hash(password)\n\ndef verify_password(plain_password: str, hashed_password: str) -> bool:\n return pwd_context.verify(plain_password, hashed_password)\n\n# Ge\u00e7ici kullan\u0131c\u0131 veritaban\u0131 (ger\u00e7ek uygulamada bir veritaban\u0131 kullan\u0131lmal\u0131)\n# Parolalar hashlenmi\u015f olarak saklanmal\u0131\nfake_users_db = {\n \"testuser\": {\n \"username\": \"testuser\",\n \"email\": \"test@example.com\",\n \"full_name\": \"Test User\",\n \"disabled\": False,\n \"hashed_password\": get_password_hash(\"supersecret\"),\n }\n}\n\ndef get_user(username: str):\n if username in fake_users_db:\n user_dict = fake_users_db[username]\n return UserInDB(**user_dict)\n return None\n <\/code><\/pre>\n<\/p><\/div>\nUser<\/code> ve UserInDB<\/code> modelleri, kullan\u0131c\u0131 bilgilerini temsil ederken, Token<\/code> ve TokenData<\/code> modelleri JWT ile ilgili verileri yap\u0131land\u0131rmak i\u00e7in kullan\u0131l\u0131r. pwd_context<\/code> objesi, parolalar\u0131 hash’lemek ve do\u011frulamak i\u00e7in gerekli fonksiyonlar\u0131 sa\u011flar. fake_users_db<\/code> ise, ger\u00e7ek bir veritaban\u0131 entegrasyonuna ge\u00e7meden \u00f6nce test ama\u00e7l\u0131 kullanabilece\u011fimiz basit bir bellek i\u00e7i (in-memory) veri deposudur. Ger\u00e7ek bir projede PostgreSQL, MongoDB gibi kal\u0131c\u0131 bir veritaban\u0131 kullanman\u0131z gerekecektir. Her b\u00f6l\u00fcm minimum 300 kelime hedefine ula\u015fmak i\u00e7in bu temel yap\u0131land\u0131rma ad\u0131mlar\u0131n\u0131 detayland\u0131rmak, her bir bile\u015fenin neden \u00f6nemli oldu\u011funu a\u00e7\u0131klamak ve olas\u0131 g\u00fcvenlik risklerine de\u011finmek kritik \u00f6neme sahiptir. \u00d6rne\u011fin, SECRET_KEY<\/code>‘in g\u00fcvenli\u011fi, bcrypt<\/code>‘in se\u00e7ilme nedenleri ve fake_users_db<\/code> yerine ger\u00e7ek bir veritaban\u0131n\u0131n gereklili\u011fi gibi noktalar \u00fczerinde durulabilir. Bu ba\u015flang\u0131\u00e7 ad\u0131mlar\u0131, FastAPI ile g\u00fcvenli bir API geli\u015ftirme yolculu\u011funun sa\u011flam temellerini olu\u015fturur.<\/p>\nKullan\u0131c\u0131 Kimlik Do\u011frulama ve JWT Olu\u015fturma S\u00fcre\u00e7leri<\/h2>\n
Token Olu\u015fturma Fonksiyonu<\/h3>\n
config.SECRET_KEY<\/code> ile imzalayarak bir JWT d\u00f6nd\u00fcrecektir.<\/p>\n\n# main.py (veya ayr\u0131 bir auth.py dosyas\u0131)\nfrom datetime import datetime, timedelta\nfrom typing import Optional\nfrom jose import JWTError, jwt\nfrom fastapi import Depends, HTTPException, status\nfrom fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm\n\nfrom config import SECRET_KEY, ALGORITHM, ACCESS_TOKEN_EXPIRE_MINUTES # config.py'dan import ettik\n\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\") # \"token\" endpoint'i login i\u00e7in kullan\u0131lacak\n\ndef create_access_token(data: dict, expires_delta: Optional[timedelta] = None):\n to_encode = data.copy()\n if expires_delta:\n expire = datetime.utcnow() + expires_delta\n else:\n expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)\n to_encode.update({\"exp\": expire})\n encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)\n return encoded_jwt\n <\/code><\/pre>\n<\/p><\/div>\nexp<\/code> (expiration time – son kullanma zaman\u0131) alan\u0131n\u0131 ekler. Bu alan, token’\u0131n ne zaman ge\u00e7ersiz olaca\u011f\u0131n\u0131 belirtir ve g\u00fcvenlik a\u00e7\u0131s\u0131ndan \u00f6nemlidir. Token’\u0131n k\u0131sa \u00f6m\u00fcrl\u00fc olmas\u0131, \u00e7al\u0131nmas\u0131 durumunda potansiyel zarar\u0131 minimize eder. Bu y\u00fczden ACCESS_TOKEN_EXPIRE_MINUTES<\/code> de\u011ferini makul bir s\u00fcrede tutmak \u00f6nemlidir.<\/p>\nKullan\u0131c\u0131 Giri\u015f (Login) Endpoint’i<\/h3>\n
OAuth2PasswordRequestForm<\/code> ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 kullanarak form verilerini kolayca alman\u0131z\u0131 sa\u011flar.<\/p>\n\n# main.py\nfrom fastapi import FastAPI\nfrom fastapi.responses import JSONResponse\n\napp = FastAPI()\n\n# ... (Yukar\u0131daki User, UserInDB, Token, TokenData, get_password_hash, verify_password, get_user, create_access_token tan\u0131mlamalar\u0131 buraya gelecek) ...\n\n@app.post(\"\/token\", response_model=Token)\nasync def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):\n user = get_user(form_data.username)\n if not user or not verify_password(form_data.password, user.hashed_password):\n raise HTTPException(\n status_code=status.HTTP_401_UNAUTHORIZED,\n detail=\"Kullan\u0131c\u0131 ad\u0131 veya parola hatal\u0131\",\n headers={\"WWW-Authenticate\": \"Bearer\"},\n )\n access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)\n access_token = create_access_token(\n data={\"sub\": user.username}, expires_delta=access_token_expires\n )\n return {\"access_token\": access_token, \"token_type\": \"bearer\"}\n <\/code><\/pre>\n<\/p><\/div>\n\/token<\/code> endpoint’i, kullan\u0131c\u0131dan kullan\u0131c\u0131 ad\u0131 ve parola al\u0131r. get_user<\/code> fonksiyonu ile kullan\u0131c\u0131y\u0131 bellek i\u00e7i veritaban\u0131m\u0131zdan bulur ve verify_password<\/code> ile parolas\u0131n\u0131 do\u011frular. E\u011fer kimlik bilgileri yanl\u0131\u015fsa, HTTPException<\/code> y\u00fckseltilerek 401 Yetkisiz (Unauthorized) hatas\u0131 d\u00f6nd\u00fcr\u00fcl\u00fcr. Ba\u015far\u0131l\u0131 olursa, create_access_token<\/code> fonksiyonu ile bir JWT olu\u015fturulur ve bu token istemciye JSON yan\u0131t\u0131 olarak g\u00f6nderilir. \"sub\"<\/code> (subject) claim’i genellikle kullan\u0131c\u0131n\u0131n benzersiz kimli\u011fini (\u00f6rne\u011fin, kullan\u0131c\u0131 ad\u0131) tutar.<\/p>\nJWT Token Do\u011frulama Ba\u011f\u0131ml\u0131l\u0131\u011f\u0131<\/h3>\n
\n# main.py\n# ... (Di\u011fer import'lar ve fonksiyonlar) ...\n\nasync def get_current_user(token: str = Depends(oauth2_scheme)):\n credentials_exception = HTTPException(\n status_code=status.HTTP_401_UNAUTHORIZED,\n detail=\"Kimlik bilgileri do\u011frulanamad\u0131\",\n headers={\"WWW-Authenticate\": \"Bearer\"},\n )\n try:\n payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])\n username: str = payload.get(\"sub\")\n if username is None:\n raise credentials_exception\n token_data = TokenData(username=username)\n except JWTError:\n raise credentials_exception\n user = get_user(token_data.username)\n if user is None:\n raise credentials_exception\n return user\n\nasync def get_current_active_user(current_user: User = Depends(get_current_user)):\n if current_user.disabled:\n raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=\"Devre d\u0131\u015f\u0131 b\u0131rak\u0131lm\u0131\u015f kullan\u0131c\u0131\")\n return current_user\n <\/code><\/pre>\n<\/p><\/div>\nget_current_user<\/code> fonksiyonu, oauth2_scheme<\/code> ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 kullanarak iste\u011fin ba\u015fl\u0131\u011f\u0131ndan JWT’yi al\u0131r. Ard\u0131ndan, jwt.decode<\/code> ile token’\u0131 \u00e7\u00f6z\u00fcmler ve imzas\u0131n\u0131 do\u011frular. E\u011fer token ge\u00e7erliyse, payload’dan kullan\u0131c\u0131 ad\u0131n\u0131 (sub<\/code> claim) \u00e7\u0131kar\u0131r. Herhangi bir hata durumunda (ge\u00e7ersiz token, s\u00fcresi dolmu\u015f token, imza hatas\u0131 vb.), HTTPException<\/code> y\u00fckseltilir. get_current_active_user<\/code> ise, kullan\u0131c\u0131n\u0131n aktif olup olmad\u0131\u011f\u0131n\u0131 kontrol eden ek bir katmand\u0131r. Bu ba\u011f\u0131ml\u0131l\u0131klar sayesinde, herhangi bir API endpoint’ine basit\u00e7e current_user: User = Depends(get_current_active_user)<\/code> ekleyerek o endpoint’i koruma alt\u0131na alabiliriz. Bu mod\u00fcler yakla\u015f\u0131m, kod tekrar\u0131n\u0131 \u00f6nler ve g\u00fcvenlik mant\u0131\u011f\u0131n\u0131 merkezi bir yerde tutar. Bu detayl\u0131 ad\u0131mlar, bir YZ m\u00fchendisinin FastAPI uygulamalar\u0131nda kullan\u0131c\u0131 kimlik do\u011frulamas\u0131n\u0131 ve JWT olu\u015fturma\/do\u011frulama s\u00fcre\u00e7lerini eksiksiz bir \u015fekilde anlamas\u0131n\u0131 ve uygulamas\u0131n\u0131 sa\u011flar. \u00d6zellikle, token ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netimi ve hata i\u015fleme mekanizmalar\u0131, sa\u011flam bir g\u00fcvenlik altyap\u0131s\u0131 i\u00e7in vazge\u00e7ilmezdir.<\/p>\nKorumal\u0131 Rotalar ve Yapay Zeka Servislerinin G\u00fcvenli\u011fi<\/h2>\n
Basit Bir Korumal\u0131 Rota Olu\u015fturma<\/h3>\n
get_current_active_user<\/code> ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 kullanarak, herhangi bir FastAPI rotas\u0131n\u0131 kolayca koruma alt\u0131na alabiliriz. Bu ba\u011f\u0131ml\u0131l\u0131k, iste\u011fin yetkilendirme ba\u015fl\u0131\u011f\u0131nda ge\u00e7erli bir JWT olup olmad\u0131\u011f\u0131n\u0131 kontrol eder ve e\u011fer varsa, kimli\u011fi do\u011frulanm\u0131\u015f aktif kullan\u0131c\u0131 nesnesini rotaya enjekte eder. E\u011fer token yoksa, ge\u00e7ersizse veya kullan\u0131c\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131lm\u0131\u015fsa, FastAPI otomatik olarak 401 veya 400 durum kodlar\u0131yla uygun bir hata yan\u0131t\u0131 d\u00f6nd\u00fcr\u00fcr.<\/p>\n\n# main.py\n# ... (Yukar\u0131daki t\u00fcm tan\u0131mlamalar ve app = FastAPI() sat\u0131r\u0131) ...\n\n@app.get(\"\/users\/me\/\", response_model=User)\nasync def read_users_me(current_user: User = Depends(get_current_active_user)):\n \"\"\"\n Mevcut oturum a\u00e7m\u0131\u015f kullan\u0131c\u0131n\u0131n bilgilerini d\u00f6nd\u00fcr\u00fcr.\n Bu rota JWT ile korunmaktad\u0131r.\n \"\"\"\n return current_user\n\n# Yapay Zeka Modeli Tahmin Servisi \u00d6rne\u011fi\nclass PredictionRequest(BaseModel):\n text: str\n\nclass PredictionResponse(BaseModel):\n prediction: str\n confidence: float\n\n@app.post(\"\/ai\/predict\/\", response_model=PredictionResponse)\nasync def ai_predict(request: PredictionRequest, current_user: User = Depends(get_current_active_user)):\n \"\"\"\n Bir metin girdisi al\u0131r ve yapay zeka modelimizden bir tahmin d\u00f6nd\u00fcr\u00fcr.\n Sadece yetkili kullan\u0131c\u0131lar bu servisi kullanabilir.\n \"\"\"\n print(f\"Kullan\u0131c\u0131 '{current_user.username}' taraf\u0131ndan AI tahmin iste\u011fi al\u0131nd\u0131: {request.text}\")\n \n # Burada ger\u00e7ek yapay zeka modeli \u00e7a\u011fr\u0131s\u0131 yap\u0131l\u0131r.\n # \u00d6rnek olarak basit bir metin analizi yapal\u0131m:\n if \"k\u00f6t\u00fc\" in request.text.lower() or \"negatif\" in request.text.lower():\n prediction = \"Negatif Duygu\"\n confidence = 0.95\n elif \"iyi\" in request.text.lower() or \"pozitif\" in request.text.lower():\n prediction = \"Pozitif Duygu\"\n confidence = 0.88\n else:\n prediction = \"N\u00f6tr Duygu\"\n confidence = 0.70\n \n return {\"prediction\": prediction, \"confidence\": confidence}\n\n# Uygulamay\u0131 \u00e7al\u0131\u015ft\u0131rma (terminalde: uvicorn main:app --reload)\n <\/code><\/pre>\n<\/p><\/div>\n\/users\/me\/<\/code> rotas\u0131, kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131n\u0131n kendi bilgilerini almas\u0131n\u0131 sa\u011flar. Bu, kullan\u0131c\u0131 profil sayfalar\u0131 veya yetkilendirme kontrolleri i\u00e7in s\u0131k\u00e7a kullan\u0131lan bir desendir. Daha da \u00f6nemlisi, \/ai\/predict\/<\/code> rotas\u0131, bir yapay zeka modelinin tahmin servisini temsil eder. Bu servise yap\u0131lan her istek, get_current_active_user<\/code> ba\u011f\u0131ml\u0131l\u0131\u011f\u0131 sayesinde \u00f6nce kimlik do\u011frulama kontrol\u00fcnden ge\u00e7er. Bu sayede, yaln\u0131zca ge\u00e7erli bir JWT’ye sahip, aktif kullan\u0131c\u0131lar bu tahmin servisini kullanabilir. \u0130\u00e7erideki print<\/code> ifadesi, hangi kullan\u0131c\u0131n\u0131n iste\u011fi yapt\u0131\u011f\u0131n\u0131 loglaman\u0131za olanak tan\u0131r, bu da denetim (auditing) ve g\u00fcvenlik izleme a\u00e7\u0131s\u0131ndan de\u011ferlidir.<\/p>\nGer\u00e7ek D\u00fcnya Senaryosu: Finansal Doland\u0131r\u0131c\u0131l\u0131k Tespit API’s\u0131<\/h3>\n
\n
\u0130leri D\u00fczey JWT Kullan\u0131m\u0131 ve G\u00fcvenlik \u0130pu\u00e7lar\u0131<\/h2>\n
Token Yenileme (Refresh Token) Mekanizmalar\u0131<\/h3>\n
\n
Authorization: Bearer<\/code>) ta\u015f\u0131n\u0131r.<\/li>\n\/refresh<\/code> endpoint’ine istek g\u00f6nderir. Sunucu, yenileme token’\u0131n\u0131 do\u011frular, e\u011fer ge\u00e7erliyse yeni bir eri\u015fim token’\u0131 (ve iste\u011fe ba\u011fl\u0131 olarak yeni bir yenileme token’\u0131) olu\u015fturur ve istemciye g\u00f6nderir. Bu, kullan\u0131c\u0131lar\u0131n s\u00fcrekli giri\u015f yapmak zorunda kalmadan g\u00fcvenli bir \u015fekilde oturumlar\u0131n\u0131 s\u00fcrd\u00fcrmelerini sa\u011flar.<\/p>\n\n# config.py\n# ...\nREFRESH_TOKEN_EXPIRE_DAYS = 7 # Yenileme token'\u0131n\u0131n ge\u00e7erlilik s\u00fcresi (g\u00fcn)\n\n# main.py\n# ...\ndef create_refresh_token(data: dict, expires_delta: Optional[timedelta] = None):\n to_encode = data.copy()\n if expires_delta:\n expire = datetime.utcnow() + expires_delta\n else:\n expire = datetime.utcnow() + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)\n to_encode.update({\"exp\": expire})\n encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)\n return encoded_jwt\n\n# \/token endpoint'ini g\u00fcncelleyelim\n@app.post(\"\/token\", response_model=Token)\nasync def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):\n # ... (Kullan\u0131c\u0131 do\u011frulama k\u0131sm\u0131 ayn\u0131) ...\n access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)\n access_token = create_access_token(\n data={\"sub\": user.username}, expires_delta=access_token_expires\n )\n refresh_token_expires = timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)\n refresh_token = create_refresh_token(\n data={\"sub\": user.username}, expires_delta=refresh_token_expires\n )\n # Ger\u00e7ek uygulamada refresh token'\u0131 veritaban\u0131nda saklay\u0131p,\n # bir kez kullan\u0131ld\u0131ktan sonra ge\u00e7ersiz k\u0131lmak \u00f6nemlidir.\n return {\"access_token\": access_token, \"token_type\": \"bearer\", \"refresh_token\": refresh_token}\n\n# Yeni refresh endpoint'i\n@app.post(\"\/refresh\", response_model=Token)\nasync def refresh_access_token(refresh_token: str = Depends(oauth2_scheme)):\n credentials_exception = HTTPException(\n status_code=status.HTTP_401_UNAUTHORIZED,\n detail=\"Ge\u00e7ersiz yenileme token'\u0131\",\n headers={\"WWW-Authenticate\": \"Bearer\"},\n )\n try:\n payload = jwt.decode(refresh_token, SECRET_KEY, algorithms=[ALGORITHM])\n username: str = payload.get(\"sub\")\n if username is None:\n raise credentials_exception\n # Ger\u00e7ek uygulamada refresh token'\u0131n veritaban\u0131nda varl\u0131\u011f\u0131n\u0131 ve\n # daha \u00f6nce kullan\u0131l\u0131p kullan\u0131lmad\u0131\u011f\u0131n\u0131 kontrol etmelisiniz.\n except JWTError:\n raise credentials_exception\n \n user = get_user(username)\n if user is None:\n raise credentials_exception\n\n access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)\n new_access_token = create_access_token(\n data={\"sub\": user.username}, expires_delta=access_token_expires\n )\n return {\"access_token\": new_access_token, \"token_type\": \"bearer\"}\n <\/code><\/pre>\n<\/p><\/div>\n\/refresh<\/code> endpoint’inde, yenileme token’\u0131n\u0131n veritaban\u0131nda kay\u0131tl\u0131 olup olmad\u0131\u011f\u0131n\u0131 ve tek kullan\u0131ml\u0131k olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek, g\u00fcvenlik a\u00e7\u0131s\u0131ndan kritik bir ad\u0131md\u0131r. Bu, \u00e7al\u0131nan bir yenileme token’\u0131n\u0131n tekrar tekrar kullan\u0131larak yeni eri\u015fim token’lar\u0131 \u00fcretmesini engeller.<\/p>\nRol Tabanl\u0131 Eri\u015fim Kontrol\u00fc (RBAC)<\/h3>\n
\n# main.py\n# ...\nclass UserInDB(User):\n roles: list[str] = [\"user\"] # Rolleri ekledik\n\n# fake_users_db'yi g\u00fcncelleyelim:\nfake_users_db = {\n \"testuser\": {\n \"username\": \"testuser\",\n \"email\": \"test@example.com\",\n \"full_name\": \"Test User\",\n \"disabled\": False,\n \"hashed_password\": get_password_hash(\"supersecret\"),\n \"roles\": [\"user\"]\n },\n \"adminuser\": {\n \"username\": \"adminuser\",\n \"email\": \"admin@example.com\",\n \"full_name\": \"Admin User\",\n \"disabled\": False,\n \"hashed_password\": get_password_hash(\"adminsecret\"),\n \"roles\": [\"admin\", \"user\"]\n }\n}\n\n# create_access_token fonksiyonunda role bilgisini payload'a ekleyelim\ndef create_access_token(data: dict, expires_delta: Optional[timedelta] = None):\n to_encode = data.copy()\n if expires_delta:\n expire = datetime.utcnow() + expires_delta\n else:\n expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)\n to_encode.update({\"exp\": expire})\n # 'roles' bilgisini payload'a ekliyoruz\n if 'roles' in data:\n to_encode.update({\"roles\": data[\"roles\"]})\n encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)\n return encoded_jwt\n\n# get_current_user fonksiyonunda payload'dan rolleri alal\u0131m\nasync def get_current_user(token: str = Depends(oauth2_scheme)):\n credentials_exception = HTTPException(\n status_code=status.HTTP_401_UNAUTHORIZED,\n detail=\"Kimlik bilgileri do\u011frulanamad\u0131\",\n headers={\"WWW-Authenticate\": \"Bearer\"},\n )\n try:\n payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])\n username: str = payload.get(\"sub\")\n roles: list[str] = payload.get(\"roles\", [\"user\"]) # Roller yoksa varsay\u0131lan olarak \"user\"\n if username is None:\n raise credentials_exception\n token_data = TokenData(username=username, roles=roles) # TokenData modelini de g\u00fcncellememiz gerekebilir\n except JWTError:\n raise credentials_exception\n user = get_user(token_data.username)\n if user is None:\n raise credentials_exception\n user.roles = token_data.roles # Kullan\u0131c\u0131 nesnesine rolleri ekle\n return user\n\n# Rol kontrol\u00fc i\u00e7in yard\u0131mc\u0131 fonksiyon\ndef has_role(required_roles: list[str]):\n def role_checker(current_user: User = Depends(get_current_active_user)):\n for role in required_roles:\n if role not in current_user.roles:\n raise HTTPException(\n status_code=status.HTTP_403_FORBIDDEN,\n detail=\"Bu i\u015fleme eri\u015fim yetkiniz yok\"\n )\n return current_user\n return role_checker\n\n# Admin rol\u00fc gerektiren bir rota \u00f6rne\u011fi\n@app.post(\"\/admin\/model_update\/\")\nasync def update_ai_model(current_user: User = Depends(has_role([\"admin\"]))):\n \"\"\"\n Yapay zeka modelini g\u00fcncelleyen bir admin rotas\u0131.\n Sadece 'admin' rol\u00fcne sahip kullan\u0131c\u0131lar eri\u015febilir.\n \"\"\"\n return {\"message\": f\"AI modeli {current_user.username} taraf\u0131ndan g\u00fcncellendi.\"}\n <\/code><\/pre>\n<\/p><\/div>\nhas_role<\/code> fonksiyonu, belirli bir rol\u00fcn gerekli oldu\u011fu rotalar i\u00e7in bir ba\u011f\u0131ml\u0131l\u0131k olu\u015fturur. Bu sayede, Depends(has_role([\"admin\"]))<\/code> gibi basit bir ifadeyle bir rotay\u0131 belirli rollere sahip kullan\u0131c\u0131larla s\u0131n\u0131rlayabiliriz. TokenData<\/code> modeline de roles: list[str]<\/code> alan\u0131 eklemeyi unutmay\u0131n.<\/p>\nDi\u011fer G\u00fcvenlik \u0130pu\u00e7lar\u0131<\/h3>\n
\n
SECRET_KEY<\/code>, asla koda g\u00f6m\u00fclmemeli ve ortam de\u011fi\u015fkenleri, anahtar y\u00f6netim sistemleri (AWS KMS, Azure Key Vault) veya Kubernetes Secret’lar\u0131 gibi g\u00fcvenli mekanizmalarla y\u00f6netilmelidir.<\/li>\nSonu\u00e7 ve S\u0131k\u00e7a Sorulan Sorular<\/h2>\n
S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n
\n
\"roles\": [\"admin\", \"user\"]<\/code>). Sunucu taraf\u0131nda, korumal\u0131 rotalara eri\u015fimden \u00f6nce, gelen token’\u0131n payload’\u0131ndaki rolleri kontrol eden bir ba\u011f\u0131ml\u0131l\u0131k (FastAPI’de Depends<\/code> ile) tan\u0131mlan\u0131r. E\u011fer kullan\u0131c\u0131n\u0131n gerekli rollere sahip olmad\u0131\u011f\u0131 tespit edilirse, 403 Yasak (Forbidden) hatas\u0131 d\u00f6nd\u00fcr\u00fcl\u00fcr.<\/p>\n<\/li>\n