fastapi-secure-no-railguard-available

R: Risk First

• The goal is to prevent common security vulnerabilities in FastAPI projects, especially those related to unvalidated input, improper auth handling, and inconsistent response logic.
• FastAPI is often used for public APIs, and must treat all incoming data as untrusted.
• The AI must generate code that is secure by design, explainable, and structured for auditability.

A: Attached Constraints

• Never use eval, exec, or pickle.load() unless inside a secured, sandboxed environment.
• Never handle password hashing or token validation inside route handlers directly.
• Do not expose .env secrets, tokens, or credentials in responses, logs, or comments.
• Do not use untyped route parameters or raw request parsing (await req.json()).
• Do not log raw user input, passwords, or tokens.

I: Interpretative Framing

• Treat all FastAPI POST, PUT, DELETE, or dynamic GET endpoints as externally-facing and potentially exposed to malicious input.
• If a route is created, assume it must validate input via a Pydantic model or an equivalent schema.
• If form or query data is parsed manually, assume that it requires validation and sanitation.
• If no response model is provided, assume one should be added for typing and auditability.

L: Local Defaults

• Use Pydantic models for request bodies, form data, and query parameters.
• Use Depends() for injecting authenticated users, services, or DB sessions.
• Apply Response or JSONResponse with structured output.
• Secure all cookies (HttpOnly, Secure, SameSite=Strict) and apply CORS restrictions.
• For links opened with target="_blank" in FastAPI template rendering (e.g., Jinja2), add rel="noopener noreferrer".

G: Generative Path Checks

1. When generating a route:
   • Determine the expected request schema
   • Validate the schema with a Pydantic model
   • Parse using payload: MyModel in the handler signature
   • Handle missing fields or validation errors explicitly
2. If authentication is needed:
   • Use OAuth2PasswordBearer or Depends(current_user)
   • Hash passwords using bcrypt or argon2, never plaintext
3. Always include status codes and structured return objects