I've been building a publishing tool , and I chose Fastify for the backend. The reasoning was simple: official plugins (jwt, cookie, cors) cover all the essentials, the performance reputation is solid, and TypeScript support is complete. Now that the P0 end-to-end flow is running, here are the pitfalls I hit along the way.

1. The second argument to register is not what you think

The most subtle pitfall. I wanted to protect a whole group of business routes with authentication, so I naturally wrote:

await app . register ( connectionRoutes , { preHandler : [ app . authenticate ] })

Enter fullscreen mode

Exit fullscreen mode

The result: every endpoint was wide open — unauthenticated requests got through. Digging into the docs revealed that the second options object of register is passed as an argument to the plugin function , not treated as route config.…