Lesson 3: Who may see order 5521, and how to prove it
17 min read·13 Oct 2026
Module 10 · Lesson 3 · About 45 minutes · Needs: Lesson 1 (FastAPI routes, dependencies and TestClient)The situation
Sam, BrightCart's security lead, asks Lesson 1's web service for order 5521, Aisha Rahman's robot vacuum, with no name and no password. The service hands it over. "What stops Tom Becker reading Aisha's orders?"
Nothing does, yet. This lesson adds the missing pieces one at a time, all traced through that one order. Every response you see is a real one from TestClient.