🚀 FastAPI With Google OAuth 2.0 And CORS, CSRF Protection, Secure Cookies

When building modern web applications, authentication is one of the most critical pieces. With users demanding secure, seamless, and reliable login flows, integrating Google OAuth 2.0 becomes a popular choice.

In this article, I’ll walk you through a secure Google OAuth 2.0 implementation using FastAPI, Authlib, and session-based authentication, with all the right security measures like CSRF protection, secure cookies, and environment-based configurations.

✅ Features

• 🔐 Google OAuth 2.0 Integration

• 🧠 Session-Based Authentication (no JWT headaches)

• 🛡️ CSRF Protection using OAuth2 State parameter

• 🌍 CORS Configuration for frontend support

• 🔧 Manual Token Exchange (no hidden Authlib bugs)

• 📦 Environment-based Config with .env

• ❌ Secure Cookie Management with HttpOnly + Secure flags

• ✅ Error Handling & Validation for safe user flows

🛠️ Tech Stack

• Backend Framework → FastAPI (lightning-fast Python web framework)

• Authentication & OAuth → Authlib + Google OAuth 2.0

• Session Management → Starlette Sessions + ItsDangerous (secure cryptographic cookies)

• HTTP & Async → Uvicorn + HTTPX

• Configuration → Pydantic + python-dotenv

• Security → CORS, CSRF Protection, Secure Cookies

🔐 OAuth 2.0 Flow

Here’s how the Google OAuth 2.0 login works in this project:

1. Initiate Login → /login redirects to Google

2. Callback → /callback handles Google’s redirect with an auth code

3. Token Exchange → Exchange code for access + ID tokens

4. User Info → Fetch profile from Google API

5. Session Creation → Store user securely in session (signed cookie)

6. Auth Check → /me returns current authenticated user

7. Logout → /logout clears the session

🌐 API Endpoints

⚙️ Setup & Installation

Clone the repo and install dependencies:

git clone https://github.com/kuldeepghorpade05/Google_OAuth_with_FastAPI.gi
cd fastapi-google-oauth
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

🔑 Environment Variables

Create a .env file in the root directory:

GOOGLE_CLIENT_ID=your_google_client_id
GOOGLE_CLIENT_SECRET=your_google_client_secret
SECRET_KEY=your_random_secret_key
SESSION_COOKIE_NAME=fastapi_session
BASE_URL=http://localhost:8000
ALLOWED_ORIGINS=http://localhost:3000

🚀 Running the App

uvicorn app.main:app --reload

Now open:
👉 http://localhost:8000/api/v1/auth/login

1. Authenticate with Google

2. Get redirected back with session created

3. Use /api/v1/auth/me to check logged-in user

4. Logout anytime using /api/v1/auth/logout

🧪 Testing the Flow

• Start login → /login

• Redirect to Google

• Callback & token exchange → /callback

• Session stored → /me returns profile

• Logout → /logout

🔒 Why This Matters

Authentication is often the weakest link in security. By using:

• Sessions (instead of exposing JWT in localStorage)

• CSRF Protection (via state parameter)

• Secure Cookies (HttpOnly + Secure flags)

…you ensure your FastAPI app is both user-friendly and highly secure.

🎯 Final Thoughts

This project demonstrates a production-ready Google OAuth 2.0 implementation in FastAPI with:

• Strong session security

• Clean, modular architecture

• Frontend-friendly CORS setup

• Easy .env configuration for different environments

👉 Perfect for SaaS apps, dashboards, or any project requiring Google login.

📂 Source Code

You can check out and fork the full project on GitHub here:

👉 Fork on GitHub -> https://github.com/kuldeepghorpade05/Google_OAuth_with_FastAPI.git

Connect with me

• GitHub

• LinkedIn

• Personal website