FastAPI Penetration Testing for Dependencies, Scopes and Response Data
FastAPI validates the request body and builds interactive documentation from type hints, but it does not decide who is allowed to call a route or what a response should contain. Those decisions live in the Depends and Security dependencies, response_model declarations and CORSMiddleware settings a developer adds route by route. We test what was actually declared on each endpoint, not what the framework’s own tutorial demonstrates. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
FastAPI does not apply a security dependency, a scope check or a response filter unless a route declares it. We test what every route actually declares against what it needs to enforce.
Why FastAPI findings are what a route never declared
FastAPI does not ship a built-in permission system the way some frameworks do. Authorisation exists only where a developer adds it, through a Depends or Security dependency on one route, an APIRouter’s own dependencies parameter, or the dependencies list passed to include_router when a router is mounted. Where scopes are used for finer-grained permissions, FastAPI’s OAuth2 scopes documentation shows SecurityScopes checking the scopes a route asks for against the scopes a token was issued, and that comparison is application code the developer writes rather than something FastAPI enforces on its own.
The same opt-in pattern applies to what a route sends back. response_model filters a response down to the fields it declares even when the object returned holds more, which is exactly how FastAPI’s own SQL database tutorial keeps a secret field out of its example API. Skip response_model, or type a route’s return value as something other than a Pydantic model, and there is nothing left to do the filtering, so whatever the function returns is what goes out. Object ownership sits on the other side of the same request: FastAPI validates that a path parameter matches its declared type, not whether the caller is entitled to the record that ID points to, so that check has to be written into the dependency or the route by hand.
Everything around the request needs the same attention. /docs, /redoc and /openapi.json are all served by default, CORSMiddleware asks the developer to name the allowed origins rather than assuming none, and a task queued with BackgroundTasks runs after the response has already gone out, using whatever arguments the route handler gave it. We test whether each of those was set for the environment the service is actually running in, not for the tutorial it was copied from.
SCOPE
What we pen test on a FastAPI application
Route-Level Dependency Authorisation
A Depends or Security dependency added to a path operation decorator runs before the handler and can reject the request before it does anything, but it only applies to routes where it was actually added. We check every route in scope for the dependency it should carry against the one it actually carries, including routes added after the initial build where copying a decorator is easy to get wrong.
Router-Level Dependency Inheritance
An APIRouter can carry its own dependencies parameter, and include_router can add another set when that router is mounted, with FastAPI combining whatever each level declares rather than one router’s rule extending automatically to another. We test whether a new router mounted alongside an existing one repeats the authorisation dependency its siblings carry, rather than assuming it inherited one.
OAuth2 Scopes and SecurityScopes Enforcement
Scopes are declared per route with Security(dependency, scopes=[…]), and the dependency that receives SecurityScopes is the code that checks each required scope against the scopes a token was actually issued. We test whether that comparison runs on every scoped route and whether a token can be issued carrying more scopes than the requesting account should hold.
Object Ownership Checks
FastAPI validates that a path or query parameter matches its declared type, not whether the caller is entitled to the record that ID points to. We test whether an endpoint that takes an ID from the request checks ownership before returning or changing that record, and whether the check is applied consistently across GET, PUT, PATCH and DELETE on the same route.
Response Model Filtering vs Raw ORM Returns
response_model filters a response down to the fields it declares even when the object returned carries more, the same technique FastAPI’s own SQL tutorial uses to keep a secret field out of its example API. We test every route that returns a database object for a declared response_model or return type, and what actually reaches the client on the routes that have neither.
Auto-Generated Docs and OpenAPI Schema Exposure
FastAPI serves interactive documentation at /docs and /redoc and the schema itself at /openapi.json by default, listing every route, parameter and model in the application unless docs_url, redoc_url or openapi_url is set to disable it. We test what an unauthenticated request to each of those paths reveals about internal routes, field names and authentication schemes before judging whether that exposure matches what the application is meant to publish.
CORS Middleware Configuration
CORSMiddleware defaults to a restrictive position and asks the developer to name the allowed origins, methods and headers explicitly, and will not accept a wildcard origin alongside allow_credentials. We test the configured allow_origins list against the origins the application actually needs, and check for a wildcard left over from local development once credentials are involved.
Background Task Argument Handling
A task queued with BackgroundTasks runs after the response has already been sent, using whatever arguments the route handler passed to add_task, including request data the handler received. We test what a background task does with that data, particularly where a task writes to a file, calls another service or reaches a queue without repeating the checks the request-handling code already applied.
WebSocket Endpoint Authentication
A WebSocket route uses the same Depends mechanism as an HTTP route, and FastAPI’s own WebSocket documentation authenticates its example connection with a session cookie or a token read from the query string. We test how a WebSocket endpoint authenticates the connection and whether a token travelling in the URL ends up somewhere it can be read back, such as a proxy access log or browser history.
Python Surface Beyond the Request Cycle
A FastAPI service rarely runs alone: startup and shutdown events, a scheduled job or a worker consuming a queue share the same models and database access as the API but sit outside any per-route dependency. Where that Python surface extends beyond a single FastAPI service, our wider Python penetration testing covers it too.
OUR PROCESS
FastAPI Penetration Testing: From Scope to Attestation
Scope and Test Accounts
We agree the routes, environments and a test account for each OAuth2 scope or permission tier in use, plus whether background workers, admin routes or a decoupled frontend sit in or out of scope.
Dependency and Response Mapping
We map every route’s Depends and Security wiring, the scopes each one needs, and which routes declare a response_model, against what the application actually has to enforce and return.
Hands-On Testing
A CREST-certified tester works through route and router authorisation, scope enforcement, response data exposure, CORS configuration and docs exposure by hand, chaining findings where one weakness leads to another.
Report and Retest
You receive a technical report with CVSS-scored findings and reproduction steps, a walkthrough call, a free retest once fixes are live, and an attestation letter for your auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST FastAPI pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent FastAPI Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test FastAPI For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From FastAPI Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our FastAPI service?
We need a test account for every OAuth2 scope or permission tier your API defines, plus a valid token or session for each one. If routes are grouped behind different APIRouter instances with their own dependencies, tell us during scoping so we can request access to each group rather than just the ones visible from the OpenAPI schema.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes, outbound emails and live payment processing, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a FastAPI penetration test take?
A single FastAPI service sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. A service with more scopes, a larger route count or several integrations moves into a wider scope with more testing days.
Do you test FastAPI running on serverless or managed platforms as well as our own servers?
Yes. FastAPI is an ASGI application served by Uvicorn or a similar server, and we test it the same way whether that is on your own infrastructure, in a container, or behind a managed platform. FastAPI itself is a framework you deploy and control rather than a shared multi-tenant service, so there is no FastAPI vendor testing policy to follow; if the hosting platform has its own penetration-testing policy, we confirm it during scoping.
Should /docs and /openapi.json stay open during testing?
Leave them configured however they normally run. Testing includes checking what an unauthenticated request to /docs, /redoc and /openapi.json reveals, and whether that matches what you intend to publish, rather than assuming either state is correct beforehand.
Are BackgroundTasks and any queue workers behind the service in scope?
Yes, if you want them covered. A background task queued with BackgroundTasks runs with whatever arguments the handler gave it, and a separate worker consuming a queue sits outside FastAPI’s own request handling entirely, so tell us during scoping if either should be included.
What is out of scope for a single-framework FastAPI test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope for this test and covered by our cloud penetration testing service instead. A separate frontend application consuming the API, such as a decoupled React or Vue app, is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant Depends, Security and response_model declarations alongside testing, is available if you want faster or deeper coverage of specific routes.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your FastAPI service
FastAPI validates the request body and builds interactive documentation from type hints, but it does not decide who is allowed to call a route or what a response should contain. Those decisions live in the Depends and Security dependencies, response_model declarations and CORSMiddleware settings a developer adds route by route. We test what was actually declared on each endpoint, not what the framework’s own tutorial demonstrates. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
