CORS middleware setup in FastAPI - Performance & Optimization

Performance: CORS middleware setup

MEDIUM IMPACT

This affects the initial network request handling and response time by adding headers to allow cross-origin requests.

Allowing cross-origin requests safely and efficiently

FastAPI

from fastapi import FastAPI
from starlette.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],  # Restrict to trusted origins
    allow_credentials=True,
    allow_methods=["GET", "POST"],
    allow_headers=["Authorization", "Content-Type"]
)

Restricting origins and methods reduces unnecessary preflight requests and improves security.

📈 Performance GainReduces network round-trips and speeds up resource loading, improving LCP.

Allowing cross-origin requests safely and efficiently

FastAPI

from fastapi import FastAPI
from starlette.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],  # Allow all origins
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Allowing all origins with '*' can cause security risks and unnecessary preflight requests, increasing latency.

📉 Performance CostTriggers extra OPTIONS preflight requests, adding network round-trips and delaying LCP.

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Allow all origins with '*'	0	0	0	[!] OK but can cause extra network delay
Restrict origins and methods	0	0	0	[OK] Best for performance and security

Rendering Pipeline

CORS middleware runs on the server before the response is sent. It adds headers that control browser behavior for cross-origin requests, affecting network timing and resource loading.

→Network Request Handling

→Response Preparation

⚠️ BottleneckNetwork round-trips caused by preflight OPTIONS requests

Core Web Vital Affected

LCP

This affects the initial network request handling and response time by adding headers to allow cross-origin requests.

Optimization Tips

1Avoid using '*' for allow_origins to prevent extra preflight requests.

2Specify only needed HTTP methods and headers to reduce network overhead.

3Test CORS setup with browser DevTools to ensure minimal preflight requests.

Performance Quiz - 3 Questions

What is a common performance issue caused by allowing all origins with '*' in CORS?

A Larger CSS file sizes

B Extra preflight OPTIONS requests causing network delays

C Increased DOM reflows on the client

D Slower JavaScript execution

DevTools: Network

How to check: Open DevTools, go to Network tab, filter by 'OPTIONS' requests, and observe if preflight requests occur frequently.

What to look for: Fewer OPTIONS requests and faster response times indicate efficient CORS setup.

Practice

1. What is the main purpose of adding CORS middleware in a FastAPI application?

easy

A. To speed up the API response time

B. To control which external websites can access your API

C. To handle database connections securely

D. To log all incoming requests for debugging

Solution

1. Step 1: Understand CORS middleware role

   CORS middleware is used to manage cross-origin requests, which means controlling which websites can call your API.

2. Step 2: Identify the correct purpose

   Among the options, only controlling external website access matches the role of CORS middleware.

3. Final Answer:

   To control which external websites can access your API -> Option B

4. Quick Check:

   CORS controls access permissions [OK]

Hint: Remember: CORS = Cross-Origin Resource Sharing control [OK]

Common Mistakes:

• Confusing CORS with performance optimization
• Thinking CORS manages database security
• Assuming CORS logs requests

2. Which of the following is the correct way to add CORS middleware in FastAPI?

easy

A. app.middleware(CORSMiddleware, allow_origins=["*"])

B. app.use(CORSMiddleware, allow_origins=["*"])

C. app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["GET"])

D. app.add_cors(allow_origins=["*"])

Solution

1. Step 1: Recall FastAPI middleware syntax

   FastAPI uses app.add_middleware() to add middleware components like CORSMiddleware.

2. Step 2: Check option syntax correctness

   app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["GET"]) uses app.add_middleware with CORSMiddleware and proper parameters, matching FastAPI docs.

3. Final Answer:

   app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["GET"]) -> Option C

4. Quick Check:

   Use add_middleware() to add CORS [OK]

Hint: FastAPI middleware always uses add_middleware() method [OK]

Common Mistakes:

• Using app.use() which is not FastAPI syntax
• Trying app.middleware() instead of add_middleware()
• Calling a non-existent add_cors() method

3. Given this FastAPI code snippet, what will be the effect of the CORS middleware?

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

@app.get("/")
async def root():
    return {"message": "Hello"}

medium

A. Only requests from https://example.com with GET or POST methods are allowed

B. All origins and methods are allowed

C. No requests are allowed because allow_origins is too restrictive

D. Only GET requests from any origin are allowed

Solution

1. Step 1: Analyze allow_origins and allow_methods

   allow_origins is set to ["https://example.com"], so only that origin is allowed. allow_methods includes GET and POST.

2. Step 2: Determine request permissions

   Requests from other origins or methods not in GET/POST will be blocked by CORS policy.

3. Final Answer:

   Only requests from https://example.com with GET or POST methods are allowed -> Option A

4. Quick Check:

   allow_origins and allow_methods restrict access [OK]

Hint: Check allow_origins and allow_methods lists carefully [OK]

Common Mistakes:

• Assuming allow_origins=["*"] when it is not
• Ignoring allow_methods restrictions
• Thinking all origins are allowed by default

4. Identify the error in this FastAPI CORS middleware setup:

app.add_middleware(
    CORSMiddleware,
    allow_origins="*",
    allow_methods=["GET", "POST"],
    allow_headers=["*"]
)

medium

A. CORSMiddleware must be imported from fastapi.middleware.security

B. allow_methods should be a string, not a list

C. allow_headers cannot contain '*'

D. allow_origins should be a list, not a string

Solution

1. Step 1: Check allow_origins type

   allow_origins must be a list of strings, but here it is a single string "*".

2. Step 2: Verify other parameters

   allow_methods is correctly a list, allow_headers can accept ["*"] as a list.

3. Final Answer:

   allow_origins should be a list, not a string -> Option D

4. Quick Check:

   allow_origins requires a list [OK]

Hint: Always use a list for allow_origins, even if one item [OK]

Common Mistakes:

• Passing allow_origins as a string instead of list
• Misunderstanding allow_methods type
• Wrong import path for CORSMiddleware

5. You want your FastAPI backend to accept requests from two frontend domains: https://app1.example.com and https://app2.example.com. You also want to allow all HTTP methods and headers. Which CORS middleware setup is correct?

hard

A. app.add_middleware(CORSMiddleware, allow_origins=["https://app1.example.com", "https://app2.example.com"], allow_methods=["*"], allow_headers=["*"])

B. app.add_middleware(CORSMiddleware, allow_origins=["*"])

C. app.add_middleware(CORSMiddleware, allow_origins=["https://app1.example.com", "https://app2.example.com"], allow_methods=["GET", "POST"], allow_headers=["Content-Type"])

D. app.add_middleware(CORSMiddleware, allow_origins="https://app1.example.com,https://app2.example.com", allow_methods=["*"], allow_headers=["*"])

Solution

1. Step 1: Set allow_origins correctly

   To allow two specific domains, use a list with both URLs as strings.

2. Step 2: Allow all methods and headers

   Using ["*"] for allow_methods and allow_headers allows all HTTP methods and headers.

3. Step 3: Check for syntax correctness

   app.add_middleware(CORSMiddleware, allow_origins=["https://app1.example.com", "https://app2.example.com"], allow_methods=["*"], allow_headers=["*"]) correctly uses a list for origins and lists with "*" for methods and headers.

4. Final Answer:

   app.add_middleware(CORSMiddleware, allow_origins=["https://app1.example.com", "https://app2.example.com"], allow_methods=["*"], allow_headers=["*"]) -> Option A

5. Quick Check:

   List origins + wildcard methods/headers [OK]

Hint: Use list for origins and ["*"] to allow all methods/headers [OK]

Common Mistakes:

• Passing origins as a single comma string
• Using allow_methods with limited verbs instead of wildcard
• Setting allow_origins to ["*"] when only specific domains needed