When is 1.42 being released? And dynamic user signups?

Christopher7 · January 28, 2025, 9:30pm

Hey folks. I’ve had a very had time getting user accounts and authentication working in my streamlit app. I see in the roadmap (https://roadmap.streamlit.app/) that Authentication & st.user is “Ready for launch”, so I’m tempted to just wait until that’s released. So, 3 questions:

Will that be in streamlit 1.42?
If so, can anyone tell me what date 1.42 will be released?
The road map caption says “Add authentication to your Streamlit app with a config file, and check via st.user which user is logged in.” Does this mean it will only support a fixed list of users, specified in the config file? Or will it also support on-demand user signups, making it suitable for my SaaS business that I want to scale rapidly?

Marco5 · January 31, 2025, 7:21am

Yes, that feature will be part of the 1.42 release as you can see from the live streaming they had this week:

I have no idea about when it will be released, but it’s a matter of hours I guess.

Finally, the auth feature will be based on the following repo

and, it’s also discussed here:

github.com/streamlit/streamlit

[Coming soon] Native authentication support for Streamlit

opened 12:33AM - 17 Apr 24 UTC

closed 02:57PM - 08 Jan 25 UTC

sfc-gh-jcarroll

type:enhancement area:server area:backend

### Summary We are investigating approaches to add native authentication supp…ort for Streamlit, as it is one of the top most requested community features. This is a rough proposal for how it might work, which is shared for your feedback. ### Goals **Goal 1:** Provide the building blocks for integrating more robust auth solutions including: - documented support for reading headers (replace the undocumented but heavily used `_get_websocket_headers()` - native support for reading and writing cookies ( #861 ) - native redirect ( #7123 ) - hooks to add identity information in `st.user` - _[longer term]_ Support custom http endpoints ( #439 ) - this will be a bigger effort but know we probably need to get there eventually to have a really robust support - ??? What else ??? **Goal 2:** Provide an out-of-the-box native integration which covers the most common use cases, especially for developers getting started. To that end, we propose **standardizing on OAuth2 & OpenID Connect as the natively supported protocols in Streamlit**. - This would be an opinionated and minimal implementation, geared towards integrating with standardized OIDC providers. - Goal would be, with a few lines of config / secrets, you can be set up with `login()` / `logout()` methods and the users verified email, OAuth2 token, and potentially other claims from a JWT readily available through a standard API (likely attributes on `st.user`). - Ideally, include an easy integration with cookies support so it's trivial to maintain the user auth session across tabs for some time. However, we still need to investigate whether this is feasible or has other major implications. **Why OpenID Connect (OIDC)?** - From our perspective, OIDC seems like the most modern, standardized authentication protocol we can use which enables a standard format of user identity claims (including roles / groups) and minimal custom code across providers. - We also see a wide range of adoption across identity providers both in the consumer space (Google, Apple, etc) and enterprise space (Auth0, AWS Cognito, MSFT Entra ID, etc). - For most app developers who aren't working in a more sophisticated existing platform, it seems to cover the typical use case for "single sign on" for relatively low fuss and configuration required in the provider side. **Non-goal: Replace the use of reverse proxy in higher security environments** We know this practice of running Streamlit behind an auth proxy and forwarding authenticated requests to the app is fairly common among Streamlit usage in bigger companies or those with higher security requirements. We want to build library features that make that easier to run (such as documented headers support) but not replace it or build extremely hardened security into Streamlit, since it isn't our expertise. But, we think this proposal can still unblock many developers operating in somewhat lower stakes environments who experience a lot of friction today. ### VERY ROUGH API sketch Here's a very rough first idea of how the API might work for the built-in OIDC. ```toml # .streamlit/secrets.toml or similar [auth] # reserved group for defining auth, could also support multiple like [auth.google] type = "oidc" provider = "google" # or api_base_url="accounts.google.com" client_id = "SOME ID" client_secret = "SOME SECRET" default_ttl = "7d" # if we have some easy cookie support ``` Once this is configured, you can call some standard methods in the app which will redirect to the appropriate OIDC flow. Streamlit will automatically expose an OAuth2 callback endpoint which handles the response from the identity provider. In the case below, calling `login()` will simply redirect to the OAuth2 flow. When the user returns from the flow, their identity values will be available in `st.user`. Calling `logout()` will clear the values from `st.user` in that session along with any browser cookies. ```python # streamlit_app.py if st.user.logged_in(): # verify log in, including cookie from an earlier session st.write(f"Welcome, {st.user.name}!") st.sidebar.button("Logout", on_click=st.user.logout) else: st.sidebar.button("Login", on_click=st.user.login) ``` ### Other authentication protocols We know other protocols are used today, such as looking up a username / password in a database (e.g. [Streamlit-Authenticator](https://github.com/mkhorasani/Streamlit-Authenticator)), or more complex delegated authentication schemes like SAML / LDAP. In some cases, the existing plugins / components for these can work pretty well. We'd like to provide some hooks to make them more consistent with the native support (maybe similar to `st.connection`), but it may not be in the initial launch. ### What do you think? If this proposal and approach sounds good and meets your use case, please give a 👍 . Also, we'd love to hear any comments about what you like, don't like, or would change, or any use case you have which would not be supported. Thanks!!

Topic		Replies	Views
New Streamlit Release: 0.54.0 Official Announcements release-notes	6	3043	August 15, 2022
Simple Authentication for Streamlit Apps Show the Community! authentication	25	13954	January 30, 2025
Streamlit Authenticator-Users disappear after every reboot Community Cloud discussion , st-authenticator	0	21	November 14, 2024
Streamlit-Authenticator, Part 1: Adding an authentication component to your app Show the Community!	58	7522	September 7, 2024
Adding authentication to your Streamlit app (including SSO, MFA, Invitations, RBAC, etc) Show the Community! tutorial , authentication	1	839	October 30, 2024

When is 1.42 being released? And dynamic user signups?

Related topics

Hello there 👋🏻

Cookie settings

Strictly necessary cookies

Performance cookies

Functional cookies

Targeting cookies