Building web APIs with Python: Flask and FastAPI
You write validated, authenticated and tested JSON APIs with Flask and FastAPI and avoid common web security mistakes from the start.
Level 301 · 18 lessons · 18 practice labs
Lessons
Flask
- The life cycle of a web request and WSGI
- Routes, requests and responses with Flask
- Templates and automatic escaping
- Forms and CSRF protection
- Sessions and secure cookie settings
- Short task: a notebook app with Flask
FastAPI
- Your first API with FastAPI and ASGI
- Request validation with pydantic
- Dependency injection and a database session
- Authentication: password hashing and tokens
- Authorisation: stopping access to other users' records
- Short task: an inventory API with FastAPI
Getting ready for production
- API tests with the test client
- Rate limits and consistent error responses
- CORS and security headers
- Running with gunicorn and uvicorn
- Short task: harden an API that has flaws
Capstone
- Capstone: an authenticated ticketing API
Practice labs
- Validating a path parameter in a Flask route: Write a Flask route that takes a product id with the int converter and returns 404 with a JSON body when not found.
- Finding the line that disables escaping in a template: Fix a comments template that runs script because of |safe and verify with a test that a malicious comment shows as plain text.
- Adding CSRF protection to a form: Add a session-bound CSRF token to a password change form so a POST without it returns 400.
- Hardening the session cookie: Add Secure, HttpOnly and SameSite to the session cookie, read the hard-coded secret from the environment and renew the session at login.
- Validating a booking request with pydantic: Write a pydantic model for Lavanta Otel's booking endpoint that checks date order and guest count rules.
- Removing secret fields from a response: Limit a user endpoint that also returns the password hash with response_model and prove with a test the field is gone.
- Providing a database session as a dependency: Move endpoints that use a global connection to a yield dependency and override it with an in-memory database in tests.
- Bringing error responses to one shape: Write exception handlers that return validation, not-found and unexpected errors in one JSON shape without leaking internals.
- Replacing plain hashes with a strong password hash: Move sign-up code that stores SHA-256 passwords to a salted, slow password hash, upgrading old users at first login.
- Rejecting expired tokens: Add an expiry to a signed access token and return 401 for expired or tampered tokens.
- Closing access to someone else's record: Add an ownership check to an endpoint that returns another user's note when the id is changed and write a regression test.
- Tying admin endpoints to a role: Gather the role check in one dependency, apply it to every admin route and scan with a test that none is left unprotected.
- Testing a CRUD flow with the test client: Test the create, read, update and delete flow of a task API end to end with the test client.
- Limiting login attempts: Add a limit of five attempts per minute per IP to the login endpoint, answering excess requests with 429 and Retry-After.
- Fixing loose CORS and missing headers: Replace a CORS setup that allows every origin with an allow-list and verify a middleware that adds security headers with tests.
- Turning off debug mode and detailed errors: Tie the application's debug mode to an environment setting and return a generic message instead of a stack trace on unexpected errors, writing the detail only to the server log.
- Overriding a dependency in tests: Override the database dependency with an in-memory fake in the test client so each test starts with clean data and the real database is never touched.
- Testing authorisation rules with a table: Write the expected status codes for three roles across all endpoints as a table and verify them with parametrised tests, then close the open endpoint the tests catch.
About this course
You write validated, authenticated and tested JSON APIs with Flask and FastAPI and avoid common web security mistakes from the start.
What you will learn
- Flask
- FastAPI
- Getting ready for production
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.