Fastapi security

Skill dkmqflx/fastapi-best-practices-plugin/plugins/fastapi-best-practices/skills/fastapi-security

Claude Code plugin: FastAPI best practices (41 rules, 13 categories) grounded in the official FastAPI docs

Install

npx -y skills add dkmqflx/fastapi-best-practices-plugin --skill fastapi-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

FastAPI security and authentication best practices. Use when implementing or reviewing auth in FastAPI — OAuth2PasswordBearer, get_current_user dependencies, router-level auth, password hashing, token endpoints. Triggers on OAuth2PasswordBearer, OAuth2PasswordRequestForm, get_current_user, or Depends-based auth.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, 404 tokens by cl100k_base, as published. Nobody here has run it

FastAPI Security & Authentication

Best practices for securing FastAPI applications, following the official security docs (https://fastapi.tiangolo.com/tutorial/security/). Covers extracting and validating Bearer tokens, resolving the current user as a dependency, protecting route groups, hashing passwords, and building the token-issuing endpoint. Each rule pairs an antipattern with the official FastAPI pattern.

When to Apply

Reference these guidelines when:

Extracting or validating a Bearer token from the Authorization header
Resolving the current authenticated user in a dependency
Protecting a group of routes at the APIRouter level
Hashing and verifying passwords
Building the /token (or equivalent) login endpoint

Rules

oauth2-bearer (CRITICAL) — extract Bearer tokens with OAuth2PasswordBearer + Annotated
get-current-user (CRITICAL) — resolve the current user in a get_current_user dependency
router-auth (HIGH) — protect route groups via APIRouter(dependencies=[...])
password-hashing (CRITICAL) — hash passwords (pwdlib/passlib); never store plaintext
token-endpoint (HIGH) — build the token route with OAuth2PasswordRequestForm

How to Use

Read the individual rule file for the detailed explanation and before/after example:

rules/oauth2-bearer.md
rules/get-current-user.md
rules/router-auth.md
rules/password-hashing.md
rules/token-endpoint.md

Each rule file contains:

A short explanation of why it matters, tied to the official docs
An Incorrect example (the antipattern)
A Correct example (the official pattern)
A link to the relevant page on https://fastapi.tiangolo.com/

All examples follow the official FastAPI documentation and avoid deprecated APIs.

Gives 0 of the 12 instructions most security skills give in 404 tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-06

parameterize all database queriesin 67 of 648, across 49 files
hash passwords using bcrypt scrypt or argon2in 48 of 648, across 35 files
apply rate limiting to authentication endpointsin 48 of 648, across 24 files
Configure security headersin 35 of 648, across 18 files
validate all inputsin 32 of 648, across 24 files
validate all external input at the system boundaryin 29 of 648, across 18 files
run containers as a non-root userin 28 of 648, across 15 files
use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
run dependency audits before every releasein 21 of 648, across 10 files
encode output to prevent cross-site scriptingin 21 of 648, across 10 files
copy dependencies before source codein 20 of 648, across 9 files
store secrets in environment variablesin 20 of 648, across 17 files

Said here and by no other author read

extract bearer tokens with oauth2passwordbearer and annotated
resolve current user in a get_current_user dependency
protect route groups via apirouter dependencies
hash passwords using pwdlib or passlib
build the token route with oauth2passwordrequestform

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.