New CS proposal: FastAPI

FastAPI security cheat sheet

The proposed Cheat Sheet will focus on security best practices and common pitfalls when building APIs using FastAPI, a modern Python web framework.

FastAPI introduces unique architectural patterns such as dependency injection, async request handling, automatic data validation via Pydantic, OAuth2 helpers, and OpenAPI auto-generation, which require framework-specific security guidance. This Cheat Sheet will provide practical, FastAPI-centric recommendations rather than generic API security advice.

Commonly encountered security issues includes:

• Improper authentication and authorization due to misuse of dependency injection
• Insecure OAuth2 and JWT implementations (token storage, validation, expiry handling)
• Over-trusting Pydantic validation without additional business-logic validation
• Missing or incorrect role-based access control (RBAC)
• Insecure CORS configuration (overly permissive origins and headers)
• Sensitive data exposure via automatic OpenAPI / Swagger UI
• Lack of request rate limiting and abuse protection
• Improper exception handling leading to information leakage
• Unsafe background tasks and async operations
• Insecure file upload and deserialization patterns
• Misconfiguration when deploying with ASGI servers (Uvicorn, Gunicorn)

Objective of the Cheat Sheet:

• Provide clear, actionable security guidance specific to FastAPI
• Help developers avoid common framework-specific security mistakes
• Demonstrate secure implementation patterns using idiomatic FastAPI code
• Bridge the gap between generic API security principles and real-world FastAPI usage
• Serve as a quick reference for developers, reviewers, and security engineers working with FastAPI APIs

Other resources that exist in this area:

• OWASP REST Security Cheat Sheet
• OWASP Python Security Project
• OWASP API Security Top 10
• While these provide strong general guidance, they do not address FastAPI-specific constructs such as dependency injection, async execution, or built-in OAuth2 helpers.
• FastAPI documentation includes security examples, but they are implementation-focused and do not cover threat modeling, misuse cases, or common anti-patterns.
• Third-party resources:
• Blog posts and tutorials on JWT/OAuth2 in FastAPI (often inconsistent or insecure)
• GitHub examples with varying security quality