FastAPI redirection for trailing slash returns non-ssl link

user_2309498 0
Viewed 9036

Running into an issue when we call an endpoint and a redirect occurs due to a missing trailing slash. As you can see in the image below, when a request is made to https://.../notifications, the FastAPI server responds with a redirect to http://...notifications/

I suspect that it's an app configuration issue rather than a server configuration issue. Does anyone have an idea of how to resolve this issue?

example of redirect

uvicorn fastapi python-3.x
2 Answers

This is because your application isn't trusting the reverse proxy's headers overriding the scheme (the X-Forwarded-Proto header that's passed when it handles a TLS request).

There's a few ways we can fix that:

  • If you're running the application straight from uvicorn server, try using the flag --forwarded-allow-ips '*'.

  • If you're running gunicorn you can set as well the flag --forwarded-allow-ips="*".

  • In either application, you can additionally use the FORWARDED_ALLOW_IPS environment variable.

Important: the * should be used only as a test, as it'll lead your application to trust the X-Forwarded-* headers from any source. I suggest you read uvicorn's docs and gunicorn's docs for a deeper knowledge of what to set in this flag and why.

user_65800470

I experienced this issue when using FastAPI with react-admin.

One workaround is to change FastAPI app so it doesn't make redirects, but treats both URLs as valid API endpoints (with and without slash).

You can use this snippet wrote by malthunayan to change behaviour of APIRouter:

from typing import Any, Callable

from fastapi import APIRouter as FastAPIRouter
from fastapi.types import DecoratedCallable


class APIRouter(FastAPIRouter):
    def api_route(
        self, path: str, *, include_in_schema: bool = True, **kwargs: Any
    ) -> Callable[[DecoratedCallable], DecoratedCallable]:
        if path.endswith("/"):
            path = path[:-1]

        add_path = super().api_route(
            path, include_in_schema=include_in_schema, **kwargs
        )

        alternate_path = path + "/"
        add_alternate_path = super().api_route(
            alternate_path, include_in_schema=False, **kwargs
        )

        def decorator(func: DecoratedCallable) -> DecoratedCallable:
            add_alternate_path(func)
            return add_path(func)

        return decorator

source: https://github.com/tiangolo/fastapi/issues/2060#issuecomment-834868906

(you can also see other similar solutions in this GitHub issue)

Another workaround is to add:

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

to index.html file in frontend. It will upgrade all requests from http to https (also when run locally, so it may not be the best workaround)

user_88964570
Related