security-best-practices

Prevent SQL injection by always using parameterized queries instead of string formatting with user input. Use placeholders like $1 with raw connections, or SQLAlchemy ORM filters and text() with bound parameters, which escape values automatically.

Hash passwords using passlib's CryptContext with the bcrypt scheme, never storing plaintext. Enforce a minimum length of 12 characters before hashing, and verify logins with the context's verify method against the stored hash.

Validate user input by defining Pydantic models with Field constraints like min_length, max_length, pattern, and ge/le bounds. Add custom field_validator methods for business rules such as rejecting reserved usernames.

FastAPI supports CSRF protection through custom dependencies that compare a session-stored token against an X-CSRF-Token header on state-changing requests. Generate tokens with secrets.token_urlsafe and reject mismatches with a 403 error.

Hardcoded secrets leak through version control history, logs, and shared code, enabling credential theft. Load API keys and database URLs from environment variables or pydantic-settings with a .env file, and filter secret patterns from log output.

A web API should return X-Frame-Options DENY, X-Content-Type-Options nosniff, Strict-Transport-Security with a long max-age, and a restrictive Content-Security-Policy. Implement these via middleware that sets headers on every response.