Trusted host middleware in FastAPI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of Trusted Host Middleware in FastAPI?

Trusted Host Middleware helps protect your app by allowing requests only from specific hostnames you trust. It blocks requests from unknown or suspicious hosts.

beginner

How do you add Trusted Host Middleware in a FastAPI app?

You import TrustedHostMiddleware from starlette.middleware.trustedhost and add it to your app with app.add_middleware(TrustedHostMiddleware, allowed_hosts=[...]).

beginner

What happens if a request comes from a host not in the allowed_hosts list?

The middleware returns a 400 Bad Request response and blocks the request from reaching your app.

intermediate

Why is it important to include both domain names and localhost in allowed_hosts during development?

Including localhost allows testing on your machine, while domain names protect your app in production by only accepting trusted hosts.

intermediate

Can you use wildcards in allowed_hosts with Trusted Host Middleware?

Yes, you can use patterns like '*.example.com' to allow all subdomains of example.com.

What status code does Trusted Host Middleware return for disallowed hosts?

A 400 Bad Request

B 404 Not Found

C 403 Forbidden

D 500 Internal Server Error

Trusted Host Middleware returns 400 Bad Request when the host is not in the allowed list.

Which FastAPI method is used to add Trusted Host Middleware?

A app.use_middleware()

B app.include_middleware()

C app.add_middleware()

D app.register_middleware()

You use app.add_middleware() to add middleware like TrustedHostMiddleware in FastAPI.

Which import is correct to use Trusted Host Middleware in FastAPI?

A from fastapi.middleware.trustedhost import TrustedHostMiddleware

B from starlette.middleware.trustedhost import TrustedHostMiddleware

C from fastapi.middleware import TrustedHostMiddleware

D from starlette.middleware import TrustedHostMiddleware

TrustedHostMiddleware is imported from starlette.middleware.trustedhost.

What should you include in allowed_hosts for local testing?

A localhost and 127.0.0.1

B Only your domain name

C Only IP addresses

D No hosts needed

Include 'localhost' and '127.0.0.1' in allowed_hosts to test locally.

Can you allow all subdomains of example.com using Trusted Host Middleware?

A Only exact hostnames are allowed

B No, wildcards are not supported

C Yes, by adding 'example.*' to allowed_hosts

D Yes, by adding '*.example.com' to allowed_hosts

You can use '*.example.com' to allow all subdomains of example.com.

Explain how Trusted Host Middleware protects a FastAPI application and how to configure it.

Think about which hosts your app accepts and what happens if a host is not trusted.

Describe why including localhost in allowed_hosts is important during development with Trusted Host Middleware.

Consider how you test your app on your own computer.