FastAPI权限校验漏洞防护，你真的做对了吗？
title: FastAPI权限校验漏洞防护，你真的做对了吗？
客户端请求 → 路由处理 → 依赖项检查 → 权限验证 → 业务逻辑处理
# 订单查询接口示例
@router.get("/orders/{order_id}")
async def get_order(
order_id: int,
current_user: User = Depends(get_current_user),
db: Session = Depends(get_db)
):
order = db.query(Order).filter(Order.id == order_id).first()
if not order:
raise HTTPException(status_code=404, detail="Order not found")
# 关键权限校验
if order.owner_id != current_user.id and not current_user.is_admin:
raise HTTPException(status_code=403, detail="Permission denied")
return order
# 错误示例（存在注入风险）
dangerous_query = f"SELECT * FROM users WHERE name = '{user_input}'"
# 正确做法（使用ORM参数化）
safe_query = db.query(User).filter(User.name == user_input)
# 设置安全响应头
@app.middleware("http")
async def set_security_headers(request: Request, call_next):
response = await call_next(request)
response.headers["X-Content-Type-Options"] = "nosniff"
response.headers["X-Frame-Options"] = "DENY"
response.headers["Content-Security-Policy"] = "default-src 'self'"
return response
pip install fastapi==0.68.1 uvicorn==0.15.0 python-jose[cryptography]==3.3.0 passlib[bcrypt]==1.7.4 sqlalchemy==1.4.35 pydantic==1.10.7
from enum import Enum
class Role(str, Enum):
GUEST = "guest"
USER = "user"
ADMIN = "admin"
class UserBase(BaseModel):
username: str
email: EmailStr
disabled: bool = False
role: Role = Role.USER
from fastapi.security import OAuth2PasswordBearer
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
def require_role(required_role: Role):
async def role_checker(
current_user: User = Depends(get_current_user)
):
if current_user.role not in [required_role, Role.ADMIN]:
raise HTTPException(
status_code=403,
detail="Insufficient permissions"
)
return current_user
return role_checker
@app.get("/admin/dashboard", dependencies=[Depends(require_role(Role.ADMIN))])
async def admin_dashboard():
return {"message": "Welcome to admin panel"}
@app.get("/user/profile")
async def user_profile(
user: User = Depends(require_role(Role.USER))
):
return {"user": user.username}
评论
发表评论