CORS middleware setup in FastAPI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web development?

CORS stands for Cross-Origin Resource Sharing. It is important because it controls how resources on a web server can be requested from another domain, helping to keep web applications secure by preventing unauthorized cross-origin requests.

beginner

How do you add CORS middleware in a FastAPI application?

You add CORS middleware by importing CORSMiddleware from fastapi.middleware.cors and then using app.add_middleware() with CORSMiddleware, specifying allowed origins, methods, headers, and optionally allow_credentials.

beginner

What is the purpose of the 'allow_origins' parameter in FastAPI's CORSMiddleware?

'allow_origins' defines which domains are allowed to make cross-origin requests to your FastAPI app. It can be a list of URLs or ['*'] to allow all origins.

intermediate

Why should you avoid setting 'allow_origins' to ['*'] in production?

Setting 'allow_origins' to ['*'] allows any website to access your API, which can be a security risk. It's better to specify trusted domains to limit access.

beginner

Show a simple example of CORS middleware setup in FastAPI allowing only 'https://example.com'.

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# This setup allows only https://example.com to access the API.

What does the 'allow_methods' parameter in FastAPI's CORSMiddleware control?

A Which HTTP methods are allowed for cross-origin requests

B Which domains can access the API

C Whether cookies are allowed

D The maximum request size

'allow_methods' specifies which HTTP methods (GET, POST, etc.) are allowed in cross-origin requests.

Which FastAPI import is needed to add CORS middleware?

A from fastapi.cors import Middleware

B from fastapi.middleware import CORS

C from fastapi.middleware.cors import CORSMiddleware

D from fastapi.middleware.cors import Middleware

CORSMiddleware is imported from fastapi.middleware.cors.

What happens if you set 'allow_origins' to ['*'] in CORSMiddleware?

A No origins are allowed

B All origins are allowed to access the API

C Only localhost is allowed

D Only HTTPS origins are allowed

Setting 'allow_origins' to ['*'] means any domain can make cross-origin requests.

Which parameter allows cookies to be sent in cross-origin requests in FastAPI's CORSMiddleware?

A allow_methods

B allow_headers

C allow_origins

D allow_credentials

'allow_credentials=True' enables cookies and credentials in cross-origin requests.

Why is CORS middleware necessary in a FastAPI app?

A To control and secure cross-origin HTTP requests

B To speed up the API responses

C To handle database connections

D To manage user authentication

CORS middleware controls which external domains can access your API, enhancing security.

Explain how to set up CORS middleware in a FastAPI app to allow only specific domains.

Think about the parameters you pass to CORSMiddleware and how they control access.

Describe the security implications of using a wildcard '*' for allow_origins in CORS middleware.

Consider what happens when you open access to everyone.