Trusted host middleware in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing an allowed host?

Consider this FastAPI app with TrustedHostMiddleware configured to allow only 'example.com' and 'localhost'. What will be the HTTP status code when a request comes from 'example.com'?

FastAPI

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'localhost'])

@app.get('/')
async def root():
    return {'message': 'Hello World'}

A 200

B 400

C 404

D 500

💡 Hint

TrustedHostMiddleware blocks requests from hosts not in the allowed list.

Requests from allowed hosts pass through and get normal responses, so status code 200 is returned.

❓ component_behavior

intermediate

What happens when a disallowed host makes a request?

Given the same FastAPI app with TrustedHostMiddleware allowing only 'example.com' and 'localhost', what is the response status code when a request comes from 'malicious.com'?

FastAPI

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'localhost'])

@app.get('/')
async def root():
    return {'message': 'Hello World'}

A 200

B 400

C 404

D 403

💡 Hint

TrustedHostMiddleware returns a 400 Bad Request for disallowed hosts.

Requests from hosts not in the allowed list get a 400 Bad Request response.

📝 Syntax

advanced

Which option correctly configures TrustedHostMiddleware to allow all subdomains of example.com?

How do you configure TrustedHostMiddleware to allow 'example.com' and any subdomain like 'api.example.com'?

A app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'api.*.com'])

B app.add_middleware(TrustedHostMiddleware, allowed_hosts=['*.example.com', 'example.com'])

C app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', '*example.com'])

D app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', '*.example.com'])

💡 Hint

Wildcard subdomains must start with '*.' exactly.

Allowed hosts must include 'example.com' and '*.example.com' to cover the domain and all subdomains.

🔧 Debug

advanced

Why does this TrustedHostMiddleware configuration cause all requests to fail?

Given this code, why do all requests return 400 even from 'localhost'?

FastAPI

app.add_middleware(TrustedHostMiddleware, allowed_hosts=['localhost:8000'])

A Because allowed_hosts should not include port numbers, only hostnames

B Because 'localhost:8000' is not a valid hostname format

C Because TrustedHostMiddleware requires IP addresses, not hostnames

D Because the middleware must be added after all routes

💡 Hint

Check if ports are allowed in hostnames for TrustedHostMiddleware.

TrustedHostMiddleware matches only hostnames without ports. Including port causes mismatch and 400.

🧠 Conceptual

expert

What is the main security benefit of using TrustedHostMiddleware in FastAPI?

Why should you use TrustedHostMiddleware in your FastAPI app?

A It encrypts all incoming requests to secure data

B It automatically blocks IP addresses with too many requests

C It prevents HTTP Host header attacks by allowing only specified hosts

D It validates user authentication tokens in headers

💡 Hint

Think about what the Host header in HTTP requests can be used for in attacks.

TrustedHostMiddleware blocks requests with unexpected Host headers, preventing host header attacks.

Practice

1. What is the main purpose of the TrustedHostMiddleware in FastAPI?

easy

A. To block requests from hosts not in the allowed list

B. To speed up the response time of the app

C. To handle database connections securely

D. To manage user authentication tokens

Solution

1. Step 1: Understand middleware role

   The TrustedHostMiddleware is designed to filter incoming requests based on their host header.

2. Step 2: Identify its security purpose

   It blocks requests from hosts not explicitly allowed to protect against host header attacks.

3. Final Answer:

   To block requests from hosts not in the allowed list -> Option A

4. Quick Check:

   TrustedHostMiddleware blocks unknown hosts = D [OK]

Hint: Remember: Trusted hosts means allowed hosts only [OK]

Common Mistakes:

• Confusing it with authentication middleware
• Thinking it speeds up app performance
• Assuming it manages database connections

2. Which of the following is the correct way to add TrustedHostMiddleware to a FastAPI app?

easy

A. app.middleware(TrustedHostMiddleware, allowed=['example.com'])

B. app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com'])

C. app.use(TrustedHostMiddleware, hosts=['example.com'])

D. app.add_middleware(TrustedHostMiddleware, hosts=['example.com'])

Solution

1. Step 1: Recall FastAPI middleware syntax

   FastAPI uses app.add_middleware() with the middleware class and keyword arguments.

2. Step 2: Check correct argument name

   The correct argument for allowed hosts is allowed_hosts, not hosts or allowed.

3. Final Answer:

   app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com']) -> Option B

4. Quick Check:

   Use add_middleware with allowed_hosts = C [OK]

Hint: Use add_middleware and allowed_hosts keyword [OK]

Common Mistakes:

• Using wrong method like app.use()
• Passing 'hosts' instead of 'allowed_hosts'
• Incorrect argument names like 'allowed'

3. Given this FastAPI app code snippet, what will happen if a request comes from host 'malicious.com'?

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'localhost'])

@app.get('/')
def read_root():
    return {'message': 'Hello World'}

medium

A. The request will be redirected to 'example.com'

B. The request will succeed and return 'Hello World'

C. The app will crash with an exception

D. The request will be blocked with a 400 Bad Request error

Solution

1. Step 1: Check allowed hosts list

   The allowed hosts are 'example.com' and 'localhost'. 'malicious.com' is not in this list.

2. Step 2: Understand middleware behavior on unknown hosts

   TrustedHostMiddleware blocks requests from hosts not in the allowed list by returning a 400 error.

3. Final Answer:

   The request will be blocked with a 400 Bad Request error -> Option D

4. Quick Check:

   Unknown host causes 400 error = A [OK]

Hint: Requests from hosts not allowed get 400 error [OK]

Common Mistakes:

• Assuming the request passes through
• Thinking the app crashes on unknown hosts
• Believing the request is redirected automatically

4. Identify the error in this FastAPI app setup using TrustedHostMiddleware:

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts='example.com')

@app.get('/')
def home():
    return {'msg': 'Welcome'}

medium

A. The route function must be async

B. TrustedHostMiddleware is not imported correctly

C. allowed_hosts should be a list, not a string

D. Missing middleware initialization parameters

Solution

1. Step 1: Check allowed_hosts argument type

   The allowed_hosts parameter expects a list of strings, but a single string was given.

2. Step 2: Understand impact of wrong type

   Passing a string instead of a list will cause the middleware to treat each character as a host, leading to incorrect behavior or errors.

3. Final Answer:

   allowed_hosts should be a list, not a string -> Option C

4. Quick Check:

   allowed_hosts must be list = A [OK]

Hint: allowed_hosts always needs a list, not a string [OK]

Common Mistakes:

• Passing a single string instead of list
• Thinking route functions must be async
• Assuming import is incorrect without error

5. You want to allow requests from any subdomain of example.com and also from localhost. Which allowed_hosts list correctly configures TrustedHostMiddleware for this?

hard

A. ['*.example.com', 'localhost']

B. ['example.com', 'localhost']

C. ['example.com/*', 'localhost']

D. ['*example.com', 'localhost']

Solution

1. Step 1: Understand wildcard usage in allowed_hosts

   TrustedHostMiddleware supports wildcards like *.example.com to allow all subdomains.

2. Step 2: Check each option for correct wildcard syntax

   ['*.example.com', 'localhost'] uses '*.example.com' which correctly matches all subdomains; others use incorrect patterns.

3. Final Answer:

   ['*.example.com', 'localhost'] -> Option A

4. Quick Check:

   Use '*.example.com' for subdomains = B [OK]

Hint: Use '*.domain.com' to allow all subdomains [OK]

Common Mistakes:

• Using 'example.com/*' which is invalid
• Using '*example.com' missing dot after *
• Not using wildcard for subdomains