25-September-2026

• Python
• FastAPI
• DevOps
• Render
• REST API
• MongoDB

Python FastAPI using MongoDB with OpenAPI / Swagger serving JWT Authentication - hosted at Render cloud-based platform (Platform as a Service - PaaS)

Note: Due to the free plan at Render, the initial load time / coldstart will be around 1 minute

Try the demo by OpenAPI...

A Starter FastAPI + JWT Auth + MongoDB Atlas + OpenAPI - secured by HTTPS

DevOps by VS Code + GitHub + Render

24-September-2026

• Umbraco CMS
• .NET
• MVC
• C#
• SQLite

A Website by Umbraco 17 CMS and .NET 10 using SQLite DB for both Dev + Prod with MVC towards a custom Table in the DB serving as a Starter

The Website was upgraded from Umbraco 13 and .NET 8 which described in the Readme

This Website was created by Umbraco 17 CMS and .NET 10 and hosted at a tradiotional Web Hotel using IIS

The Website implements CRUD functionality by administrating Employees towards a custom Table in the SQLite DB using MVC and Entity Framework Core

24-September-2026

• Umbraco CMS
• .NET
• MVC
• C#
• MSSQL

My Personal Website by Umbraco 13 CMS and .NET 8 using a MSSQL Database for both Development and Production

This Website was created by Umbraco 13 CMS, .NET 8, a MSSQL Database and hosted at a tradiotional Web Hotel using IIS. The Umbraco Version 13 has a mobile friendly Backoffice which I wanted for my Website

21-September-2026

• Python
• FastAPI
• DevOps
• PostgreSQL
• Vercel
• REST API
• Vue 3
• Vite
• Tests

A production-ready starter project showcasing secure JWT authentication with Refresh Token Rotation and Refresh Token Reuse Detection using HttpOnly cookies. It includes OpenAPI / Swagger, SQLAlchemy, Alembic, PostgreSQL, and is hosted on Vercel Cloud with Serverless Functions using a GitHub-based CI/CD workflow

The included Vue 3 SPA supports silent authentication, allowing users to stay signed in even after refreshing the browser

Try the OpenAPI demo...

Try the Vue 3 SPA demo...

The project demonstrates how to build a secure REST API with FastAPI and PostgreSQL using modern JWT authentication, HTTPS, and automated database migrations

CI/CD is implemented with VS Code, GitHub, and Vercel Cloud

The Web API on GitHub

21-September-2026

• FastAPI Auth Use Cases

Python FastAPI and Vue Authentication Boilerplate Recommendations and Use Cases

Over time, I have built several FastAPI + Vue authentication projects, each introducing a different authentication strategy. The right choice depends on the security requirements, application type, and desired user experience.

1. HTTP Basic Authentication

My Project...

Recommended for:

Internal tools, small APIs, admin dashboards, and simple authenticated services.

This is the simplest authentication approach in the series. It is easy to understand and implement, making it suitable for smaller applications where users authenticate directly with a username and password.

Good use cases:

• Internal company tools
• Developer or admin dashboards
• Simple CRUD applications
• Learning FastAPI authentication dependencies

Not recommended for:

• Large public-facing applications
• Modern SPA applications requiring persistent sessions
• Systems requiring advanced token security

2. JWT Authentication (Access Tokens)

My Project...

Recommended for:

APIs and applications requiring stateless authentication.

This boilerplate introduces JWT-based authentication where users receive an access token after login. The token is then used to access protected API endpoints.

Good use cases:

• REST APIs
• Mobile applications
• Single Page Applications (SPA)
• Microservice architectures
• Systems where server-side sessions are not desired

Advantages:

• Stateless authentication
• Easy API integration
• Scales well across multiple services

Limitations:

• Users need to log in again when tokens expire
• Token revocation is more difficult

3. JWT Refresh Token Renewal

My Project...

Recommended for:

Single Page Applications and applications requiring longer user sessions.

This version introduces refresh tokens, allowing users to stay logged in after the short-lived access token expires.

Good use cases:

• Vue, React, and Angular applications
• User dashboards
• SaaS applications
• Applications where user experience is important

Advantages:

• Better user experience
• Short-lived access tokens improve security
• Users do not need frequent logins

Limitations:

• Refresh tokens must be protected carefully
• Basic refresh token handling does not detect token theft

4. JWT Refresh Token Rotation

My Project...

Recommended for:

Production applications requiring stronger session security.

Refresh token rotation improves security by replacing the refresh token every time it is used. Each refresh operation creates a new token pair.

Good use cases:

• SaaS platforms
• Customer-facing applications
• Applications handling sensitive user data
• Long-lived user sessions

Advantages:

• Reduces the lifetime of stolen refresh tokens
• Makes token replay more difficult
• Follows modern authentication practices

Limitations:

• Requires more backend logic
• Token management becomes more complex

5. Refresh Token Reuse Detection (Without HTTP-only Cookies)

My Project...

Recommended for:

Advanced authentication systems where refresh token attacks need to be detected.

This version adds detection of revoked refresh token reuse. If an old refresh token is used after rotation, the system can identify suspicious activity.

Good use cases:

• Security-focused applications
• Learning advanced authentication concepts
• Systems requiring visibility into suspicious sessions

Advantages:

• Detects refresh token replay attempts
• Improves security monitoring
• Adds protection against stolen refresh tokens

Limitations:

• Refresh tokens are still exposed to JavaScript if stored client-side
• Requires careful client-side handling

6. Refresh Token Reuse Detection with HTTP-only Cookies

My Project...

Recommended for:

Production-grade web applications with high security requirements.

This is the most advanced version in the series. It combines refresh token rotation, reuse detection, and HTTP-only cookies to reduce exposure of sensitive tokens in the browser.

Good use cases:

• Production SaaS applications
• Banking and finance systems
• Enterprise applications
• Applications handling sensitive user information

Advantages:

• Refresh tokens are protected from JavaScript access
• Detects refresh token replay attempts
• Provides stronger protection against XSS-related token theft
• Better aligned with modern browser security practices

Considerations:

• Requires CSRF protection strategies
• More complex cookie and session management

Suggested Default Choice

• Learning project: HTTP Basic Authentication or JWT Authentication
• Small production API: JWT with Refresh Token Renewal
• Modern SaaS application: Refresh Token Rotation
• Security-focused production system: Refresh Token Rotation with Reuse Detection and HTTP-only Cookies

The final HTTP-only cookie version is the strongest foundation for most new web applications, while the earlier versions remain valuable as lightweight templates depending on project requirements...

Happy coding :-)