Trusted host middleware in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing an allowed host?

Consider this FastAPI app with TrustedHostMiddleware configured to allow only 'example.com' and 'localhost'. What will be the HTTP status code when a request comes from 'example.com'?

FastAPI

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'localhost'])

@app.get('/')
async def root():
    return {'message': 'Hello World'}

A 200

B 400

C 404

D 500

💡 Hint

TrustedHostMiddleware blocks requests from hosts not in the allowed list.

Requests from allowed hosts pass through and get normal responses, so status code 200 is returned.

❓ component_behavior

intermediate

What happens when a disallowed host makes a request?

Given the same FastAPI app with TrustedHostMiddleware allowing only 'example.com' and 'localhost', what is the response status code when a request comes from 'malicious.com'?

FastAPI

from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'localhost'])

@app.get('/')
async def root():
    return {'message': 'Hello World'}

A 200

B 400

C 404

D 403

💡 Hint

TrustedHostMiddleware returns a 400 Bad Request for disallowed hosts.

Requests from hosts not in the allowed list get a 400 Bad Request response.

📝 Syntax

advanced

Which option correctly configures TrustedHostMiddleware to allow all subdomains of example.com?

How do you configure TrustedHostMiddleware to allow 'example.com' and any subdomain like 'api.example.com'?

A app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', 'api.*.com'])

B app.add_middleware(TrustedHostMiddleware, allowed_hosts=['*.example.com', 'example.com'])

C app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', '*example.com'])

D app.add_middleware(TrustedHostMiddleware, allowed_hosts=['example.com', '*.example.com'])

💡 Hint

Wildcard subdomains must start with '*.' exactly.

Allowed hosts must include 'example.com' and '*.example.com' to cover the domain and all subdomains.

🔧 Debug

advanced

Why does this TrustedHostMiddleware configuration cause all requests to fail?

Given this code, why do all requests return 400 even from 'localhost'?

FastAPI

app.add_middleware(TrustedHostMiddleware, allowed_hosts=['localhost:8000'])

A Because allowed_hosts should not include port numbers, only hostnames

B Because 'localhost:8000' is not a valid hostname format

C Because TrustedHostMiddleware requires IP addresses, not hostnames

D Because the middleware must be added after all routes

💡 Hint

Check if ports are allowed in hostnames for TrustedHostMiddleware.

TrustedHostMiddleware matches only hostnames without ports. Including port causes mismatch and 400.

🧠 Conceptual

expert

What is the main security benefit of using TrustedHostMiddleware in FastAPI?

Why should you use TrustedHostMiddleware in your FastAPI app?

A It encrypts all incoming requests to secure data

B It automatically blocks IP addresses with too many requests

C It prevents HTTP Host header attacks by allowing only specified hosts

D It validates user authentication tokens in headers

💡 Hint

Think about what the Host header in HTTP requests can be used for in attacks.

TrustedHostMiddleware blocks requests with unexpected Host headers, preventing host header attacks.