24 Security Best Practices

title: Security Best Practices in FastAPI REST APIs weight: 34 date: 2026-06-28 lastmod: 2026-06-28 description: Learn FastAPI security best practices including HTTPS enforcement, CORS, CSP headers, SQL injection prevention, rate limiting, password hashing, and dependency security. tags: [api-development, fastapi]

FastAPI security best practices combine HTTPS enforcement, Helmet-style headers via middleware, SQL injection prevention via SQLAlchemy parameterized queries, rate limiting with slowapi, and proper password hashing with passlib.

```python
from fastapi import FastAPI, Request, HTTPException
from fastapi.middleware.cors import CORSMiddleware
from fastapi.middleware.trustedhost import TrustedHostMiddleware
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded

limiter = Limiter(key_func=get_remote_address)

app = FastAPI()
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

app.add_middleware(TrustedHostMiddleware, allowed_hosts=["example.com", "*.example.com"])

@app.middleware("http")
async def security_headers(request: Request, call_next):
    response = await call_next(request)
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["X-XSS-Protection"] = "1; mode=block"
    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
    return response

@router.post("/auth/login")
@limiter.limit("5/minute")
async def login(request: Request):
    pass

What's Next

Now start the FastAPI project in Building REST APIs with FastAPI.