fastapi-secure-railguard-available

Overview

This rule provides secure-by-default coding conventions for FastAPI projects, including:

• API design and route handling
• Auth/session control
• Secure handling of path/query/body input
• Output formatting and response control
• Logging, dependency injection, and context reasoning

Input validation (e.g. pydantic, zod-like schemas, sanitization, type safety) is enforced globally via:

.cursor/rules/railguard-input-validation.mdc
(This rule uses the RAILGUARD Framework for reflective, behavioral AI reasoning.)

---

API Route Design

• Use explicit HTTP methods (@app.post, @app.get, etc.)
• Always return structured responses using JSONResponse, Response, or typed Pydantic models
• Avoid wildcard @app.route("*") routes

---

Authentication & Tokens

• Never handle JWT tokens, secrets, or password checks inside path-level routes
• Delegate to service layers or secure utility functions
• Use OAuth2PasswordBearer, not raw Authorization header parsing
• Ensure password hashing uses bcrypt or argon2; never store plaintext

---

Request Handling

• Avoid using untyped request: Request as the only parameter — instead use structured Pydantic models
• Do not parse .form(), .json() manually unless necessary — FastAPI handles this securely by default
• Always use dependency injection for DB access, background jobs, and auth checks (e.g., Depends(...))

---

Response Handling

• Avoid returning raw dictionaries or untyped JSON
• Ensure all API responses are typed, even in async def routes
• Use exception handlers (e.g. @app.exception_handler(...)) to manage untrusted input or auth failures

---

Logging & Observability

• Use the logging module, not print()
• Mask sensitive fields in logs (passwords, tokens, API keys)
• Do not log raw request bodies unless explicitly scrubbed

---

Security Add-ons

• Set security headers via middleware (e.g. X-Frame-Options, X-Content-Type-Options)
• Apply rate limiting for public-facing endpoints
• Use CORS properly — restrict allowed origins to production domains
• Avoid eval, exec, pickle.load() unless required and sandboxed