skills.rest
xeon826
xeon826COMMUNITY
Explore all skills by this author →
GitHub

security-fastapi

Audits FastAPI applications for authentication, CORS, and middleware vulnerabilities using ripgrep.

Updated Feb 9, 2025
Search Tags:#security#authentication#vulnerability#fastapi#audit#middleware#cors
One-click install
npx skills add https://github.com/xeon826/dotfiles --skill security-fastapi-xeon826
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-fastapi
Source: https://github.com/xeon826/dotfiles/tree/main/opencode/skill/security-fastapi
Command: npx skills add https://github.com/xeon826/dotfiles --skill security-fastapi-xeon826

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps developers identify and mitigate common security vulnerabilities in FastAPI applications, ensuring robust authentication, secure configurations, and protection against common web attacks.

Core Features & Use Cases

  • Authentication Auditing: Reviews the use of Depends() and Security() for proper route protection.
  • CORS Configuration Review: Checks for overly permissive CORS settings, especially when credentials are used.
  • Middleware Security: Verifies the implementation of TrustedHostMiddleware and HTTPSRedirectMiddleware.
  • API Key Security: Advises on secure handling of API keys, preferring headers over query parameters.
  • Use Case: Proactively audit an existing FastAPI application to ensure all sensitive endpoints are protected by authentication dependencies and that CORS policies are correctly configured for production environments.

Quick Start

Run the security scan script to check for common FastAPI security issues.

Frequently Asked Questions about security-fastapi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a FastAPI application for missing authentication on routes?▼

Auditing FastAPI authentication involves checking route definitions for missing `Depends()` or `Security()` dependencies. This Skill scans your codebase to identify unprotected sensitive endpoints and insecure API key schemes.

Why does wildcard CORS origin with credentials cause FastAPI security vulnerabilities?▼

Wildcard CORS origins with credentials expose FastAPI applications to cross-origin attacks by allowing any domain to make authenticated requests. This Skill reviews CORS configurations to detect overly permissive settings.

What middleware do I need to enforce HTTPS and trusted hosts in FastAPI?▼

Enforcing HTTPS and trusted hosts in FastAPI requires `TrustedHostMiddleware` and `HTTPSRedirectMiddleware`. This Skill verifies whether these essential middleware components are implemented in your application.

How to check FastAPI API key security and avoid passing keys in query parameters?▼

Checking FastAPI API key security involves verifying that keys are passed via headers rather than query parameters to prevent exposure in logs. This Skill advises on secure API key handling schemes.

Do I need ripgrep installed to run a FastAPI security audit script?▼

Yes, ripgrep is required to run this FastAPI security audit. The Skill relies on ripgrep for efficient code searching to scan for authentication dependencies, CORS configurations, and middleware implementations.

What is the best way to secure FastAPI authentication dependencies against common vulnerabilities?▼

Securing FastAPI authentication dependencies requires auditing route protection and validating API key schemes. This Skill identifies risks like missing authentication and insecure configurations to ensure robust endpoint protection.

Related Skills

Explore More Software Engineering Skills→
voidrotvoidrot

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Community
Intermediate
IgorWarzochaIgorWarzocha
124

security-fastapi

Audit FastAPI applications for authentication, CORS, and middleware security vulnerabilities.

Community
Intermediate
Kyon147Kyon147
489

shopify-app-integration-testing

Mock Shopify HTTP requests and verify routes and middleware in Laravel tests.

Community
Basic
ClearMeasureLabsClearMeasureLabs
3

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

Official
Advanced