Middleware и CORS в FastAPI

Позволяет браузерным клиентам обращаться к API с другого домена.

CORS (Cross-Origin Resource Sharing)

Позволяет браузерным клиентам обращаться к API с другого домена.

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["http://localhost:3000", "https://myapp.com"],
    allow_credentials=True,
    allow_methods=["*"],      # GET, POST, PUT, DELETE, ...
    allow_headers=["*"],
)

Для разработки (разрешить всё)

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_methods=["*"],
    allow_headers=["*"],
)

Кастомный middleware

import time
from fastapi import Request

@app.middleware("http")
async def add_process_time_header(request: Request, call_next):
    start_time = time.time()
    response = await call_next(request)
    process_time = time.time() - start_time
    response.headers["X-Process-Time"] = str(process_time)
    return response

Логирование запросов

import logging

logger = logging.getLogger(__name__)

@app.middleware("http")
async def log_requests(request: Request, call_next):
    logger.info(f"→ {request.method} {request.url}")
    response = await call_next(request)
    logger.info(f"← {response.status_code}")
    return response

Аутентификация через middleware

from fastapi.responses import JSONResponse

@app.middleware("http")
async def auth_middleware(request: Request, call_next):
    if request.url.path.startswith("/api/private"):
        token = request.headers.get("Authorization")
        if not token or not verify_token(token):
            return JSONResponse({"detail": "Unauthorized"}, status_code=401)
    return await call_next(request)

BaseHTTPMiddleware (класс)

from starlette.middleware.base import BaseHTTPMiddleware

class RateLimitMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        if is_rate_limited(request.client.host):
            return JSONResponse({"detail": "Too many requests"}, status_code=429)
        return await call_next(request)

app.add_middleware(RateLimitMiddleware)