FastAPI WebSockets Part 2: Chat Rooms. JWT Authentication. Token Expiry & Testing | #47

One big chat where anybody can be anybody isn't a real app. In Lesson 47 of the FastAPI Complete Tutorial (Beginner → Deployment), we build chat rooms – one room per course – and authentication over WebSockets, step by step, in a fresh, small project. A RoomManager line by line: a dict of rooms, join with setdefault, leave (empty rooms disappear), members, and a broadcast that reaches ONE room only. Then the auth problem: a browser WebSocket can't send an Authorization header – so the token goes in the query string (?token=…), and we compare it with a cookie and a first-message token. A WebSocket dependency validates the JWT BEFORE accept and raises WebSocketException(1008) – a real client sees HTTP 403, the TestClient sees code 1008 and the reason. Rooms only for enrolled users (authentication vs authorization), a connection that closes itself when the token expires (asyncio.wait_for with a timeout), cleanup in finally, and a teacher who announces to one room with a normal HTTP request. Two demos against a real uvicorn server, and 11 tests – including how to prove a message did NOT reach a room. 💻 Code for this video: https://github.com/nileshborate/fastapi/tree/main/47-websockets-rooms 📂 Full course code: https://github.com/nileshborate/fastapi ▶️ Full playlist: https://www.youtube.com/playlist?list=PLBjgbZvHwQmg 🌐 Website: https://www.nileshtechnology.in ⏱️ CHAPTERS 0:00 Intro 0:05 Homework answer (Video 46): private messages + no two Ashas 1:54 From one classroom to real rooms 2:39 Today's plan 3:13 Where to get the code (GitHub) 3:49 The project: users in memory 5:03 The RoomManager: broadcast to ONE room 6:32 Auth over WebSockets: no Authorization header 7:45 The ws_session dependency (before accept) 9:38 The room endpoint: enrolled users only 10:50 Closing the connection when the token expires 12:26 finally: leave the room in every case 13:03 Members + teacher announcements over HTTP 13:59 Auth demo: 403, 101 and token expired 15:10 Rooms demo: messages stay in their room 16:26 Tests: auth over WebSockets 17:51 Tests: rooms (proving a message did NOT arrive) 18:53 Before production 19:37 3 common mistakes 20:17 Interview questions 21:25 Recap, homework & what's next 📝 HOMEWORK 1. History: a new member gets the last 20 messages of the room right after joining (deque(maxlen=20) per room) 2. DELETE /rooms/{room}/members/{username} (teacher only) closes all of that user's connections in the room with code 1008 and the reason "removed by teacher" 3. Tests for both The answer is in the next video! 🎯 INTERVIEW QUESTIONS IN THIS VIDEO • How do you authenticate a WebSocket in FastAPI? • How do you build chat rooms? • What happens when the JWT expires during an open WebSocket? ⏭️ Next video: Async Deep Dive – def vs async def, the event loop, the threadpool, blocking calls and run_in_threadpool 👍 Like, subscribe to Nilesh Technology and press the bell for the next lesson! #FastAPI #Python #WebSockets #JWT #RealTime #FastAPITutorial #BackendDevelopment #PythonTutorial #NileshTechnology