FastAPI Middleware and CORS: Secure Configuration addresses a recurring problem in Python projects: Add cross-cutting request logic and allow only the browser origins your application needs. This guide explains the mechanism, provides an executable example, and identifies the boundaries that keep an implementation reliable.
Concept and use case
Middleware runs logic around every request. CORS is a browser-enforced policy for requests between different origins, where scheme, host, or port differs.
For the related fundamentals, also read the FastAPI guide. Integration stays simpler when functions receive dependencies and data explicitly instead of relying on global state.
Practical example
from fastapi import FastAPI, Request
from fastapi.middleware.cors import CORSMiddleware
app = FastAPI()
app.add_middleware(
CORSMiddleware,
allow_origins=["https://app.example.com"],
allow_credentials=True,
allow_methods=["GET", "POST"],
allow_headers=["Authorization", "Content-Type"],
)
@app.middleware("http")
async def request_id(request: Request, call_next):
response = await call_next(request)
response.headers["X-Request-ID"] = request.headers.get("X-Request-ID", "new")
return responseUse an explicit origin list when cookies or Authorization headers are involved. A wildcard does not work with credentials and grants broader access than most front ends require.
Important decisions
The correct choice depends on the public contract, expected volume, and failure behavior.
Consider concurrency, empty inputs, and partial failures. Document every limit that affects consumers and choose names that express intent.
Common mistakes
A minimal example does not replace bounds, error handling, and observability. Do not confuse CORS with authentication or a firewall. Non-browser clients can still call the API. Keep middleware short, preserve exceptions, and never log tokens.
Avoid catching exceptions without context or returning partial output as if it were complete. An explicit failure is usually safer than silently incorrect data.
How to validate
Validate behavior, not only the happy path. Test an OPTIONS preflight and a simple request from both an allowed and a blocked origin. Verify headers, status codes, and credential behavior.