Headers, Cookies & the Request Object

from fastapi import FastAPI, Header, Cookie, HTTPException

app = FastAPI()

@app.get("/profile")
def profile(
    x_api_key: str = Header(),                     # required: X-Api-Key
    user_agent: str | None = Header(default=None), # standard header, optional
    x_request_id: str | None = Header(default=None),   # tracing id from gateway
    session_id: str | None = Cookie(default=None),     # cookie by name
):
    if x_api_key != "tophub-secret-1":             # (real auth → Auth chapters)
        raise HTTPException(401, "invalid API key")
    return {
        "client": user_agent,
        "trace": x_request_id,
        "has_session": session_id is not None,
    }

# curl http://127.0.0.1:8000/profile \
#      -H "X-Api-Key: tophub-secret-1" \
#      -H "X-Request-ID: req-7f3a" \
#      --cookie "session_id=abc123"

# Notes:
#   - underscore ↔ hyphen conversion is automatic (convert_underscores=True)
#   - headers are case-insensitive per HTTP spec
#   - Authorization: Bearer <token> is usually read via Security utilities
#     (OAuth2PasswordBearer) rather than raw Header() — coming in Auth

from fastapi import FastAPI, Request, Response

app = FastAPI()

@app.post("/login")
def login(response: Response):                 # declare Response to decorate it
    response.set_cookie(
        key="session_id",
        value="sess-91f2c7",                   # (signed/random in real life)
        max_age=60 * 60 * 12,                  # 12 hours
        httponly=True,    # JS cannot read it  → XSS cannot steal the session
        secure=True,      # HTTPS only         → no leaking on plain HTTP
        samesite="lax",   # not sent on cross-site POSTs → CSRF protection
    )
    return {"status": "logged in"}

@app.post("/logout")
def logout(response: Response):
    response.delete_cookie("session_id")
    return {"status": "logged out"}

@app.get("/whoami")
def whoami(request: Request):                  # the escape hatch
    # Behind nginx/ALB, request.client.host is the PROXY's IP.
    # The real client rides in X-Forwarded-For: "client, proxy1, proxy2"
    fwd = request.headers.get("x-forwarded-for")
    real_ip = fwd.split(",")[0].strip() if fwd else request.client.host
    return {
        "ip": real_ip,
        "method": request.method,
        "path": str(request.url.path),
    }
# Caveat: X-Forwarded-For is spoofable unless a trusted proxy strips/sets it —
# only trust it when YOUR infrastructure is the one writing it.