Middleware and CORS in FastAPI

Allows browser clients to make requests to an API from a different domain.

CORS (Cross-Origin Resource Sharing)

Allows browser clients to make requests to an API from a different domain.

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["http://localhost:3000", "https://myapp.com"],
    allow_credentials=True,
    allow_methods=["*"],      # GET, POST, PUT, DELETE, ...
    allow_headers=["*"],
)

For development (allow everything)

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_methods=["*"],
    allow_headers=["*"],
)

Custom middleware

import time
from fastapi import Request

@app.middleware("http")
async def add_process_time_header(request: Request, call_next):
    start_time = time.time()
    response = await call_next(request)
    process_time = time.time() - start_time
    response.headers["X-Process-Time"] = str(process_time)
    return response

Request logging

import logging

logger = logging.getLogger(__name__)

@app.middleware("http")
async def log_requests(request: Request, call_next):
    logger.info(f"→ {request.method} {request.url}")
    response = await call_next(request)
    logger.info(f"← {response.status_code}")
    return response

Authentication via middleware

from fastapi.responses import JSONResponse

@app.middleware("http")
async def auth_middleware(request: Request, call_next):
    if request.url.path.startswith("/api/private"):
        token = request.headers.get("Authorization")
        if not token or not verify_token(token):
            return JSONResponse({"detail": "Unauthorized"}, status_code=401)
    return await call_next(request)

BaseHTTPMiddleware (class-based)

from starlette.middleware.base import BaseHTTPMiddleware

class RateLimitMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        if is_rate_limited(request.client.host):
            return JSONResponse({"detail": "Too many requests"}, status_code=429)
        return await call_next(request)

app.add_middleware(RateLimitMiddleware)