fastapi-enciphers

Encrypted session middleware for FastAPI using enciphers.

Replaces Starlette's default signed cookie session with a fully encrypted one.

Version 2.0 note: updated to match enciphers 2.0's AEAD rewrite. The step parameter no longer exists — see CHANGELOG.md for exactly what changed and why.

Installation

pip install fastapi-enciphers

Usage

from fastapi import FastAPI, Request
from fastapi_enciphers import EnciphersMiddleware
from enciphers import Backend

app = FastAPI()
app.add_middleware(EnciphersMiddleware, backend=Backend.AES256_GCM, key=42)

@app.get("/login")
async def login(request: Request):
    request.session["user_id"] = 1
    return {"status": "logged in"}

@app.get("/profile")
async def profile(request: Request):
    return {"user_id": request.session.get("user_id")}

Configuration

Parameter Type Default Description
backend Backend Backend.AES256_GCM Backend.AES256_GCM or Backend.XCHACHA20_POLY1305
key int random Secret key, a 128-bit value
key_env str None Environment variable for key
session_cookie str "session" Cookie name
max_age int 1209600 Cookie lifetime in seconds
path str "/" Cookie path
same_site str "lax" SameSite flag
https_only bool False Secure flag
domain str None Cookie domain

If key is not provided, a random 128-bit value is generated at startup — fine for local development, but every process in a real deployment needs to share the same key, or sessions won't be portable between them.

Warning: Do not use EnciphersMiddleware together with Starlette's SessionMiddleware.

Session expiry

Whenever max_age is set (the default), every session token also carries that same expiry bound inside the encrypted data itself, not just in the cookie's own Max-Age attribute — a copy of the cookie can't be replayed past that point even if a client ignores its expiration. Setting max_age=None removes both.

License

Apache-2.0 — Copyright 2026 Mejlad Alsubaie

Project links

Data verified by PyPI on Aug 3, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for mjlad from gravatar.com mjlad

Credits

Author: Mejlad Alsubaie

GitHub Statistics

Data verified by PyPI on Aug 3, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.11

Tags

enciphers encryption fastapi session starlette

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

fastapi_enciphers-2.0.0.tar.gz (8.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

fastapi_enciphers-2.0.0-py3-none-any.whl (8.1 kB view details)

Uploaded Python 3

File details

Details for the file fastapi_enciphers-2.0.0.tar.gz.

File metadata

  • Download URL: fastapi_enciphers-2.0.0.tar.gz
  • Upload date:
  • Size: 8.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for fastapi_enciphers-2.0.0.tar.gz
Algorithm Hash digest
SHA256 4ac2b4b4da51da53abfa49d33af56e063051c3a92392c260e8c20c6e279f7138
MD5 228f56533eb8f2aa8f23114d98479d81
BLAKE2b-256 2dbe45fd3480fa3af288d779d855f004ae22818ccb110ffb72b0be9b11224512

See more details on using hashes here.

Provenance

The following attestation bundles were made for fastapi_enciphers-2.0.0.tar.gz:

Publisher: publish.yml on mjlad/fastapi-enciphers

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file fastapi_enciphers-2.0.0-py3-none-any.whl.

File metadata

File hashes

Hashes for fastapi_enciphers-2.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 f97fba2f89d1b5e76faa0763908a5f1cc413100e45f4d52897df10d9845920fd
MD5 714a89b19cfbbde9b41a652dc66e979e
BLAKE2b-256 d179f178e79a90299e498fa6f18759e3b25406276728eb9c6b6729c6420105d0

See more details on using hashes here.

Provenance

The following attestation bundles were made for fastapi_enciphers-2.0.0-py3-none-any.whl:

Publisher: publish.yml on mjlad/fastapi-enciphers

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page