skills.rest
HezziCode
HezziCodeCOMMUNITY
Explore all skills by this author →
Website𝕏@huzaifasysGitHub

secure-resource-access

Enforce ownership verification on FastAPI GET and DELETE endpoints.

1|Updated Dec 9, 2025
Search Tags:#fastapi#sqlmodel#api-security#backend-security#http-exceptions#secure-access#ownership-checks
One-click install
npx skills add https://github.com/HezziCode/spec-driven-devlopment-hackathone --skill secure-resource-access
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-resource-access
Source: https://github.com/HezziCode/spec-driven-devlopment-hackathone/tree/main/phase-2-fullstack-todo/.claude/skills/secure-resource-access
Command: npx skills add https://github.com/HezziCode/spec-driven-devlopment-hackathone --skill secure-resource-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents unauthorized access to user-owned resources by enforcing strict ownership verification on GET and DELETE operations across API endpoints.

Core Features & Use Cases

  • Ownership-based access control for resources
  • Safe retrieval and deletion with proper error handling (403 and 404)
  • Real-world example: ensure a user can only view or delete their own tasks in a multi-tenant API

Quick Start

Integrate the provided ownership-verified GET and DELETE handlers into your FastAPI app to enforce user isolation and safe deletion.

Frequently Asked Questions about secure-resource-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce ownership checks for user-specific resources in a FastAPI application?▼

Ownership-based access control for user resources prevents unauthorized data retrieval by verifying the requester's identity against the resource owner, returning a 403 Forbidden error on mismatch or 404 if the resource is not found.

How do I handle HTTP exceptions when a user tries to delete another user's resource in FastAPI?▼

Handle HTTP exceptions by returning a 403 Forbidden status when the user ID does not match the resource owner, and a 404 Not Found status if the target resource does not exist in the database.

Does this ownership verification approach support safe cascade deletion of related entities?▼

Yes, this approach supports safe cascade deletion of related entities, ensuring that all dependent data associated with a user-owned resource is securely removed during a DELETE operation without orphaning records.

What is the best way to secure per-user data endpoints like /api/users/{user_id}/tasks in a multi-tenant API?▼

The best way to secure per-user data endpoints is to implement explicit ownership verification on GET and DELETE routes, ensuring users can only access or delete their own tasks with proper 403 and 404 HTTP error handling.

Can I use SQLModel with FastAPI to verify resource ownership before returning data?▼

Yes, you can use SQLModel with FastAPI to verify resource ownership by querying the database for the specific resource and validating its owner ID against the requesting user's ID before proceeding with retrieval or deletion.

Related Skills

Explore More Software Engineering Skills→
seikaikyoseikaikyo
2

fastapi-patterns

Build FastAPI backends with SQLModel, Neon PostgreSQL, and Render deployment.

Community
Advanced
karaabd23-cryptokaraabd23-crypto
1

1password

Manage 1Password CLI secrets across local automation and development workflows.

Community
Intermediate
greyhaven-aigreyhaven-ai
29

Data Validation Skill

Validate API payloads and database inputs using Pydantic v2 models.

Community
Intermediate
thejefflarsonthejefflarson
20

broken-access-control

Enforce ownership gates and role-based middleware with 404 responses.

Community
Advanced