Security Best Practices

Common threats and defenses

Protect against: SQL injection (parameterized queries), XSS (JSON response), CSRF (tokens), brute-force (rate limiting), and exposure of secrets.

Security headers

Use the @fastify/helmet plugin to set protective HTTP headers.

import helmet from '@fastify/helmet';

await fastify.register(helmet, {
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
    },
  },
});

// Sets headers: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, etc.

Secrets management

Never hardcode secrets. Use environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault).