security

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

FastAPI 0.122.0+ security error status code change

Before FastAPI version 0.122.0, integrated security utilities returned HTTP status code 403 Forbidden for failed authentication. Starting with FastAPI 0.122.0, they use HTTP status code 401 Unauthorized and return a WWW-Authenticate header in the response, following RFC 7235 and RFC 9110.

Revert to 403 Forbidden for authentication errors

To revert to the old 403 Forbidden behavior for authentication errors, override the make_not_authenticated_error method in your security classes. For example, you can create a subclass of HTTPBearer that returns a 403 Forbidden error instead of the default 401 Unauthorized error.

make_not_authenticated_error method returns exception instance

When overriding the make_not_authenticated_error method, the function returns the exception instance rather than raising it. The raising is done in the rest of the internal code.

Security flaw in hiding API documentation

Hiding API documentation in production should not be used as a security measure. Hiding documentation does not add extra security to an API because path operations remain available. If there is a security flaw in the code, it will still exist regardless of whether documentation is visible. Hiding documentation makes it more difficult to debug issues in production and is a form of security through obscurity, which is not recommended.

Better API security practices than hiding documentation

Proper API security should be achieved through well-defined Pydantic models for request bodies and responses, configuring required permissions and roles using dependencies, storing only password hashes (never plaintext passwords), using well-known cryptographic tools like pwdlib and JWT tokens, and adding granular permission controls with OAuth2 scopes where needed.

app.swagger_ui_oauth2_redirect_url for OAuth2 redirect helper

The app.swagger_ui_oauth2_redirect_url attribute provides the default OAuth2 redirect URL for Swagger UI. When using OAuth2 authentication, the swagger_ui_redirect path operation acts as a helper to handle OAuth2 provider authentication flow and allow users to return to the API docs with acquired credentials.

Full Stack FastAPI Template security features

The template includes secure password hashing by default, JWT (JSON Web Token) authentication, email-based password recovery, and tests with Pytest.

Give your agent this brain