DEV Community: Alejandro Tacoronte González

Secure Your FastAPI App in 3 Lines of Code (Without Breaking Swagger UI)

Alejandro Tacoronte González — Mon, 28 Sep 2026 14:05:00 +0000

Setting standard HTTP security headers—such as Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), and X-Frame-Options—is standard practice before shipping an API to production. They protect your users and infrastructure against common web vulnerabilities like clickjacking, MIME-type sniffing, cross-site scripting (XSS), and cross-origin resource leaks.

However, in FastAPI, developers routinely hit a frustrating roadblock the moment they attempt to enforce a strict Content Security Policy:

FastAPI's interactive documentation (/docs and /redoc) breaks immediately.

The interactive docs rely heavily on inline script execution, stylesheets, and remote assets to render Swagger UI and ReDoc properly on page load. When you add a generic, restrictive CSP middleware, the browser enforces the directives strictly, blocks those assets, and leaves you with a blank page. Developers typically end up wasting hours tuning directives by trial and error, or worse, abandoning CSP entirely.

To solve this problem cleanly, I built fastapi-security-headers.

Why This Implementation?

Many existing security header packages for Python web frameworks either wrap requests with high-level Starlette abstractions, buffer full response bodies into memory, or introduce unnecessary third-party dependencies into your dependency tree.

fastapi-security-headers was designed to be as minimal, direct, and efficient as possible:

Pure ASGI: Operates directly at the ASGI specification level. It intercepts the http.response.start message and injects headers directly into the stream without buffering payloads or wrapping request/response objects.
Pre-encoded Bytes: Headers are processed and encoded into raw tuple[bytes, bytes] structures once during application initialization. At runtime, injecting headers into a response involves virtually zero compute overhead.
Zero External Dependencies: Built strictly using Python's standard library (dataclasses, typing). It will never bloat your poetry.lock or requirements.txt.
Docs-Aware Presets: Ships with tested presets that enforce strict CSP policies while granting the precise exemptions needed for Swagger UI and ReDoc to work out of the box.
Safe for Streams and WebSockets: Automatically avoids interfering with StreamingResponse, Server-Sent Events (SSE), or WebSocket connections.
Route-Aware Precedence: Honors explicit headers set by individual route handlers, only filling in missing security policies rather than blindly overwriting endpoint behavior.

Installation

Install the package via pip:

pip install fastapi-security-headers

Quickstart: Securing Your API and Docs

The fastest way to secure an API while keeping the documentation intact is using the built-in swagger_friendly preset:

from fastapi import FastAPI
from fastapi_security_headers import SecurityHeadersMiddleware, Presets

app = FastAPI(
    title="Secure Production API",
    docs_url="/docs",
    redoc_url="/redoc"
)

# Apply baseline security headers + Swagger/ReDoc compatible CSP
app.add_middleware(
    SecurityHeadersMiddleware,
    config=Presets.swagger_friendly()
)

@app.get("/")
async def root():
    return {"status": "healthy", "security": "enforced"}

@app.get("/items/{item_id}")
async def get_item(item_id: int):
    return {"id": item_id, "name": f"Item {item_id}"}

With this single middleware configuration:

Every standard API endpoint receives strict transport and isolation headers.
Visiting /docs or /redoc loads all necessary scripts, styles, and assets without generating CSP violations in the browser console.

The Default Baseline Headers

When using fastapi-security-headers, every response is protected with the following baseline headers:

HTTP Header	Default Value	Security Impact
`X-Content-Type-Options`	`nosniff`	MIME-Sniffing: Prevents browsers from guessing content types, stopping executable payloads disguised as non-executable types like images or JSON.
`X-Frame-Options`	`DENY`	Clickjacking: Disallows any domain from rendering your site inside an `<iframe>`, preventing UI redressing attacks.
`X-XSS-Protection`	`0`	Auditor Exploits: Disables legacy browser XSS filters that have been demonstrated to introduce new vulnerabilities (per modern OWASP guidelines).
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	SSL Stripping / MitM: Instructs browsers to communicate exclusively over HTTPS for the next 12 months, including all subdomains.
`Referrer-Policy`	`strict-origin-when-cross-origin`	Data Leakage: Sends the full URL only for same-origin requests; strips query strings and paths when navigating across origins.
`Permissions-Policy`	`geolocation=(), microphone=(), camera=()`	Feature Abuse: Explicitly restricts client browsers from invoking unused device hardware APIs.
`Cross-Origin-Opener-Policy`	`same-origin`	Spectre / Process Isolation: Isolates your browsing context from cross-origin windows, preventing malicious document references.
`Cross-Origin-Resource-Policy`	`same-origin`	Cross-Origin Reads: Prevents unauthorized origins from loading your API responses as resources.

Built-In Presets

Different workloads have different requirements. You can choose between pre-configured presets depending on what your service exposes:

1. Swagger-Friendly Preset (`Presets.swagger_friendly()`)

Designed for services that serve interactive documentation. It configures a Content Security Policy that permits assets required by Swagger UI and ReDoc while keeping all other resource vectors locked down:

from fastapi import FastAPI
from fastapi_security_headers import SecurityHeadersMiddleware, Presets

app = FastAPI()

app.add_middleware(
    SecurityHeadersMiddleware,
    config=Presets.swagger_friendly()
)

2. Headless API Preset (`Presets.api()`)

Ideal for pure JSON microservices, internal services, or mobile backends that do not expose any HTML UI:

from fastapi import FastAPI
from fastapi_security_headers import SecurityHeadersMiddleware, Presets

app = FastAPI(docs_url=None, redoc_url=None)

# Restricts default-src to 'none' across all resource types
app.add_middleware(
    SecurityHeadersMiddleware,
    config=Presets.api()
)

This enforces Content-Security-Policy: default-src 'none', disallowing any browser execution of scripts, styles, frames, or plugins.

3. Strict Preset (`Presets.strict()`)

Intended for high-compliance applications (such as financial, enterprise, or healthcare software subject to PCI-DSS, SOC 2, or HIPAA):

from fastapi import FastAPI
from fastapi_security_headers import SecurityHeadersMiddleware, Presets

app = FastAPI()

# Enforces 2-year HSTS with preload flag and strict framing constraints
app.add_middleware(
    SecurityHeadersMiddleware,
    config=Presets.strict()
)

Custom Configuration

If you have specific architectural requirements or need to define custom policies, you can instantiate SecurityConfig directly:

from fastapi import FastAPI
from fastapi_security_headers import SecurityHeadersMiddleware, SecurityConfig

app = FastAPI()

custom_config = SecurityConfig(
    enable_hsts=True,
    hsts_max_age=63072000,          # 2 years
    hsts_include_subdomains=True,
    hsts_preload=True,
    content_security_policy=(
        "default-src 'self'; "
        "img-src 'self' data: https://images.example.com; "
        "script-src 'self'; "
        "frame-ancestors 'none';"
    ),
    custom_headers={
        "X-Permitted-Cross-Domain-Policies": "none",
        "Clear-Site-Data": '"cache", "cookies", "storage"'
    }
)

app.add_middleware(
    SecurityHeadersMiddleware,
    config=custom_config
)

Verifying Headers

You can verify that the headers are properly applied using curl against your local or staging server:

curl -I http://localhost:8000/

Example response:

HTTP/1.1 200 OK
content-type: application/json
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 0
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
permissions-policy: geolocation=(), microphone=(), camera=()
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
content-security-policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; img-src 'self' data: https://fastapi.tiangolo.com;

You can also submit your public URL to securityheaders.com to audit your overall compliance grade.

Feedback & Source Code

The library is completely open source under the MIT License.

GitHub Repository: aletgdev/fastapi-security-headers
PyPI Package: pypi.org/project/fastapi-security-headers

If you encounter any edge cases with custom documentation routes or want to suggest new presets, feel free to open an issue or start a discussion on GitHub.

Game Recommended AI

Alejandro Tacoronte González — Thu, 28 May 2026 19:22:00 +0000

He desarrollado una plataforma web Full-Stack diseñada para analizar de forma inteligente el sentimiento real de la comunidad de jugadores en Steam antes de realizar una compra. El objetivo principal ha sido construir un producto funcional de principio a fin, desde el modelo de Machine Learning hasta el despliegue.

🔧 Tecnologías utilizadas:
• Backend: Python & FastAPI
• IA / Machine Learning: Modelo de clasificación Naive Bayes (NLP)
• Frontend: React, Tailwind CSS
• Integraciones: Steam API

📌 Funcionalidades principales:
• Buscador predictivo: Autocompletado de juegos en tiempo real con portadas y precios extraídos de Steam.
• Análisis de sentimiento con IA: Procesamiento automatizado de decenas de reseñas en español para predecir si el juego merece la pena.
• Desglose estadístico: Visualización limpia de porcentajes de aprobación, contador de reseñas analizadas y filtrado inteligente.

Este proyecto me ha permitido trabajar aspectos clave del desarrollo moderno como:
• Despliegue e Infraestructura: Configuración de servidores web en producción.
• Procesamiento de Lenguaje Natural (NLP): Implementación de lógica para la clasificación de textos.

El proyecto ya está completamente desplegado, funcionando y listo para probarse en vivo.

¡Cualquier feedback es más que bienvenido! 🙌

Demo: https://game-recommended.alejandrotg.es/
Github: https://github.com/alejandrotg-code

🎧 Expanding the GTZAN Dataset: A Journey from YouTube to Mel Spectrograms

Alejandro Tacoronte González — Fri, 24 Apr 2026 11:08:42 +0000

I am currently finishing my specialization in Artificial Intelligence and Big Data, and I’ve decided to document the progress of my final project. This work integrates everything I’ve learned in the modules of AI Models (Modelos de Inteligencia Artificial) and Machine Learning Systems (Sistemas de Aprendizaje Automático).

The goal? A robust Music Genre Classifier. But as any data scientist will tell you, the model is only as good as the data. Today, I focused on building the "Data Kitchen": the pipeline that fetches, cleans, and prepares audio for training.

1. The Challenge: Expanding the GTZAN Dataset

While the GTZAN dataset is the industry standard, it lacks modern genres. To make my project unique, I wanted to include Lofi and Rap another others.

I used yt-dlp to source high-quality audio from YouTube. However, I ran into a classic "Junior vs. Environment" boss fight: FFmpeg.

Technical Tip: Even if you install FFmpeg via Conda, Windows sometimes hides the binaries from your Python subprocesses. I solved this by explicitly mapping the ffmpeg_location in my script to ensure the conversion to .wav never fails.

2. Standardizing for Machine Learning Systems

In our Machine Learning Systems module, we emphasized that consistency is key. To make my new data compatible with GTZAN, I had to "clone" its technical specifications:

Sample Rate: 22,050 Hz.
Channels: Mono.
Duration: Exactly 30-second segments.

I developed a script that takes a 1-hour "Lofi Study Beats" mix and slices it into perfect 30-second chunks, maintaining a strict naming convention: lofi.00000.wav, lofi.00001.wav, etc. This ensures the data is ready for bulk processing without manual intervention.

3. Feature Extraction: The Mel Spectrogram

For the AI Models part of the project, we aren't just "listening" to the audio—we are "seeing" it. Using librosa, I transform the raw waveforms into Mel Spectrograms.

The Mel scale is vital because it represents frequencies the way humans actually perceive them. It turns a complex audio signal into a 2D image, allowing me to use Convolutional Neural Networks (CNNs) to identify patterns, like the low-pass filters typical of Lofi or the sharp transients in Rap.

4. Key Takeaways for Fellow Students

Relative Paths are Dangerous: When running scripts from the terminal, ../data might point to nowhere. I switched to Path(file).resolve() to make my project portable.
Data Validation: GTZAN has a famous corrupt file (jazz.00054.wav). Learning to handle these exceptions programmatically is a crucial skill I've sharpened during this project.

Next Steps

The pipeline is clean. The data is standardized. The next phase of my final project involves designing the CNN architecture and beginning the long-awaited training phase.

Are you a student or a pro in AI? How do you handle your audio preprocessing pipelines? Let’s discuss in the comments!

Building a Movie Recommendation API with Spring Boot 🎬

Alejandro Tacoronte González — Sat, 14 Mar 2026 12:30:09 +0000

Recently I built a backend API for a movie and TV show recommendation platform using Java and Spring Boot.

The goal of the project was to practice designing a REST API, implementing authentication, and integrating an external API.

Features

The API includes several features:

Search movies and TV shows using the TMDB API
User authentication with JWT
Save favorite movies and shows
Rate content
Get trending content
RESTful API design
API documentation using Swagger / OpenAPI

Tech Stack

Backend

Java 21
Spring Boot
Spring Security
JWT Authentication
Spring Data JPA

Database

PostgreSQL

External API

TMDB API (The Movie Database)

Documentation

Swagger / OpenAPI

Example API Request

Example request to get trending content:

GET /content/trending

Example response:

{
  "page": 1,
  "results": [
    {
      "title": "War Machine",
      "release_date": "2026-02-12",
      "vote_average": 7.1
    }
  ]
}

Project Architecture

The application follows a layered architecture:

Controller → Service → Repository → Database

This structure helps keep the code organized and maintainable.

API Documentation

The API is documented using Swagger / OpenAPI, which makes it easy to explore and test the endpoints.

What I learned

While building this project I practiced several backend concepts:

Designing REST APIs
Implementing authentication with Spring Security
Using JWT for authorization
Integrating external APIs
Structuring a backend project using layered architecture

GitHub Repository

You can find the full project here:

https://github.com/alejandrotg-code/tv-and-movie-db

Feedback and suggestions are always welcome!

My first contribution to an OpenSearch project: A Junior’s journey 🚀

Alejandro Tacoronte González — Sat, 28 Feb 2026 12:30:42 +0000

🇺🇸 English Version

How it started

Hello world! I'm Alejandro, a Junior Developer currently studying AI & Big Data. Like many beginners, I used to look at huge GitHub repositories (like those from Amazon or the Linux Foundation) with a mix of respect and fear. I thought: "I'm not ready to contribute there yet."

I was wrong.

Yesterday, I made my first contribution to the opensearch-agent-server project, managed by Mingshi Liu (@mingshl), a Machine Learning Engineer at AWS OpenSearch.

It's not "just" a license

My task was to add the Apache 2.0 LICENSE file. You might think: "That's not coding!". But for a Junior, this was a masterclass in professional workflows:

Reading the Guidelines: I had to study the CONTRIBUTING.md file.
DCO (Developer Certificate of Origin): I learned that big companies require signed commits (git commit -s) for legal safety.
Communication: I had to interact in English with a Senior Engineer to get the task assigned.

The feeling

Seeing an engineer from Amazon say "thanks for taking the initiative" and seeing my name in the "Assigned" section was a huge boost for my confidence.

My advice for Juniors: Don't wait to be a Senior to contribute. Start with documentation, licenses, or small fixes. The community is waiting for you!

🇪🇸 Versión en Español

Cómo empezó todo

¡Hola a todos! Soy Alejandro, un desarrollador Junior estudiante de IA y Big Data. Como muchos principiantes, solía mirar los grandes repositorios de GitHub (como los de Amazon o la Fundación Linux) con una mezcla de respeto y miedo. Pensaba: "Todavía no estoy listo para contribuir ahí".

Estaba equivocado.

Ayer hice mi primera contribución al proyecto opensearch-agent-server, gestionado por Mingshi Liu (@mingshl), ingeniera de Machine Learning en AWS OpenSearch.

No es "solo" una licencia

Mi tarea fue añadir el archivo Apache 2.0 LICENSE. Podrías pensar: "¡Eso no es programar!". Pero para un Junior, esto fue una clase magistral de flujos de trabajo profesionales:

Leer las reglas: Tuve que estudiar el archivo CONTRIBUTING.md.
DCO (Developer Certificate of Origin): Aprendí que las grandes empresas exigen commits firmados (git commit -s) por seguridad legal.
Comunicación: Tuve que interactuar en inglés con una ingeniera Senior para que me asignaran la tarea.

La sensación

Ver a una ingeniera de Amazon decir "gracias por tomar la iniciativa" y ver mi nombre en la sección de "Asignado" fue un subidón de confianza increíble.

Mi consejo para otros Juniors: No esperes a ser Senior para contribuir. Empieza con documentación, licencias o errores pequeños. ¡La comunidad te está esperando!

Let's connect! / ¡Conectemos!

GitHub: alejandrotg-code
LinkedIn: https://www.linkedin.com/in/alejandrotacoronte/

Looking for Advice as a Junior Fullstack Developer

Alejandro Tacoronte González — Mon, 17 Nov 2025 18:50:08 +0000

Looking for Advice as a Junior Fullstack Developer (Java, Node.js, React)

Hi everyone 👋,

My name is Alejandro Tacoronte, and I completed my (Cross-Platform Application Development) studies in 2024. I’m currently looking to grow as a junior fullstack developer and would love to get advice from those with experience in the industry.

I have experience and knowledge in:

Backend: Java and Node.js
Frontend: Some experience with React
Databases: SQL
Version Control: Git

I’ve worked on projects during my studies and internships, and now I want to build my own projects that demonstrate my skills and ability to learn.

💡 I’d love to ask the community:

What “mini projects” would you recommend for a junior fullstack developer to stand out?
Which technologies or frameworks are most relevant in 2025?
Any advice on how to showcase skills effectively, even without years of professional experience?

I’d greatly appreciate any tips, resources, or personal experiences. 🙏

Thanks for reading! I’m looking forward to sharing my progress and learning alongside you all.