All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
8664 bites
Page 9
How would you use pytest fixtures to manage TestClient and mock dependencies?
Tests FastAPI test isolation and dependency overrides. Strong answer: function-scoped fixture yielding TestClient, mock injection via app.dependency_overrides, and teardown cleanup to prevent state leaks.
HTTP Basic Auth: Simple but Insecure Access Control
HTTP Basic Auth is a simple gatekeeper for your API, prompting users for a username and password directly in the browser. It's useful for internal tools, but never use it over unencrypted HTTP as credentials are sent in a trivially decodable format.
How do you test FastAPI background tasks are enqueued correctly?
This tests mocking framework hooks without firing side effects. A great answer: mock BackgroundTasks or override its dependency, assert add_task got the right function and payload, and test the sender separately.
API Keys: Simple Server-to-Server Authentication
An API key is a simple secret token a client sends to prove its identity, often in a request header. It's ideal for machine-to-machine communication where a user login flow is unnecessary. Footgun: Never send keys in URL query parameters.
How do you test a FastAPI WebSocket endpoint and lifecycle with pytest?
Tests knowledge of FastAPI TestClient usage for async WebSocket lifecycles. Use a with statement for websocket_connect; assert send, receive_json, and close; tests use standard def because TestClient handles the async app.
FastAPI: Fine-Grained Permissions with OAuth2 Scopes
Think of OAuth2 scopes as permissions on a keycard. A token gets you in the building, but scopes like items:read or items:write define which rooms you can enter. Use them in FastAPI to grant granular access.
How do router-level and app-level dependencies affect dependency override testing?
This tests FastAPI dependency hierarchy and test isolation. A strong answer states overrides are global to the app, so router-specific deps need scoped fixtures to prevent cross-test leaks. A red flag is claiming APIRouter has its own override registry.
FastAPI RBAC: Using OAuth2 Scopes for Permissions
Treat OAuth2 scopes as a list of permissions. Instead of checking a user's role, you check if their token has the required scope (e.g., items:write) for an endpoint. FastAPI's Security dependency automates this check.
How do you add a title, description, and version to FastAPI auto-docs?
Tests if you know FastAPI's metadata kwargs for OpenAPI docs. Pass title, description, and version to the FastAPI() constructor; Swagger UI and ReDoc render them automatically.
Refresh Tokens: Persistent Sessions Without Re-Authentication
A refresh token is a long-lived credential used to get a new, short-lived access token without re-authenticating. It's how apps keep you logged in for weeks. The footgun is storing it insecurely, letting attackers mint access tokens forever.
Add summary and description to a FastAPI endpoint for Swagger UI
This tests FastAPI path operation decorator configuration. Pass summary and description to @app.get, or use function docstring for description. A red flag is setting metadata inside the function body or confusing docs with Pydantic Field descriptions.
What are FastAPI's two default interactive documentation UIs and URL paths?
This tests whether you know FastAPI's built-in auto-generated docs. A strong answer names Swagger UI at /docs and ReDoc at /redoc, then notes the OpenAPI schema at /openapi.json. A weak answer confuses these with external tools or custom routes.
OpenID Connect (OIDC): Authentication as a Service
OIDC lets you delegate user login to a trusted third party, like "Sign in with Google." Your app gets a verifiable token saying who the user is, without handling their password. It's used for SSO in web apps.
How do you document multiple response schemas in OpenAPI?
This tests FastAPI OpenAPI schema generation for error responses. A strong answer covers the decorator responses dict mapping status codes to Pydantic models and descriptions, plus manually returning JSONResponse with that code.
How can you provide a Swagger UI example for a Pydantic body?
Tests whether you know FastAPI generates OpenAPI schema from Pydantic metadata. A strong answer names Field(example=...) for per-field samples and Body(example=...) for the full payload.
CSRF: Double Submit Cookies for Stateless Backends
Double Submit Cookies stop CSRF by requiring a secret in two places: a cookie and a request header. The server just checks if they match. It's useful for stateless APIs where storing server-side tokens is impractical.
How do you group FastAPI endpoints under tags and describe groups?
Tests FastAPI's two-step tag system: decorators label routes, and openapi_tags supplies group descriptions. Good answers cover tagging paths with tags=["users"], then defining metadata in FastAPI(openapi_tags=[...]) with matching names.
CORSMiddleware: Unblocking Your Frontend from Your Backend
CORS is a browser security rule, not a server bug. Use FastAPI's CORSMiddleware to tell browsers which frontends (e.g., localhost:3000) are allowed to fetch data from your API (e.g., localhost:8000).
How do you mark a FastAPI endpoint as deprecated?
This tests decorator-level OpenAPI configuration in FastAPI. Pass deprecated=True to the path operation decorator, e.g. @app.get("/old", deprecated=True), so Swagger UI shows a strikethrough. Red flag: burying a deprecation warning in the docstring instead.
FastAPI Background Tasks: Don't Make the Client Wait
FastAPI background tasks let you run slow operations, like sending an email, *after* returning a response. This keeps your API fast. The main footgun: these are fire-and-forget; a server crash means the task is lost without a real message queue.