setup-sso-subapp

Validate RS256 JWTs from a shared cookie using FastAPI by configuring PyJWKClient to fetch public keys via JWKS, enforcing strict issuer, audience, and leeway checks, and caching keys for rotation to securely authenticate sub-app users.

Cookie-based SSO authentication provisions local users in a FastAPI backend by intercepting authenticated requests, extracting claims from the validated JWT, and automatically creating or updating local user records with fallbacks for missing name fields.

Yes, you must configure CORS with allow_credentials enabled for a FastAPI sub-app using SSO cookie authentication. This allows the frontend to send the shared session cookie cross-origin alongside runtime URL injection for proper redirect handling on 401 responses.

Route a new subdomain for a FastAPI app using Docker and Caddy by configuring Caddy as a reverse proxy, injecting runtime configuration via window.__RUNTIME_CONFIG__, and disabling backend API docs by default to maintain fail-secure production defaults.

FastAPI JWT verification fails when JWKS issuer or audience checks reject mismatched token claims. Ensure PyJWKClient configuration explicitly matches the expected issuer and audience values, and apply leeway to handle minor clock skew between servers.

Prevent admin lockout when provisioning users from SSO claims by implementing zero-admin protections that block self-mutations, ensuring an authenticated user cannot disable their own admin privileges or remove the last remaining administrator account.