How do you set a custom header and cookie in FastAPI?

WHAT THIS TESTS: This question tests your understanding of FastAPI's response lifecycle and the temporal Response injection pattern. Interviewers want to see that you know how to attach metadata like headers and cookies without sacrificing FastAPI's automatic validation, serialization, and OpenAPI documentation. The key insight is that FastAPI lets you mutate a Response object that exists only during the request, then merges those mutations into the final response that carries your returned payload.

A GOOD ANSWER COVERS: First, explain the preferred approach: declare a Response parameter in the path operation function. Set custom headers by mutating the dictionary-like response.headers object, for example response.headers['X-Custom'] = 'value'. Set cookies by calling response.set_cookie with parameters like key, value, and httponly. Then return your normal data model or dictionary. Second, contrast this with returning a Response directly, such as JSONResponse, which is valid but forces you to handle serialization manually and removes the benefit of response_model filtering. Third, note that because FastAPI resolves dependencies with the same parameter injection system, a dependency can also declare a Response parameter to attach headers or cookies, which keeps cross-cutting concerns like request-id tracing reusable. Fourth, emphasize that the temporal Response object preserves all normal FastAPI behavior including status codes and background tasks.

COMMON WRONG ANSWERS: A major red flag is suggesting that you must return a raw Response object for every header or cookie, because this shows you do not understand the merge behavior and the cost of bypassing automatic docs. Another mistake is confusing request headers, which come from the client and are read via Header parameters, with response headers, which you attach to the outgoing temporal Response. Some candidates also forget that cookies have dedicated methods like set_cookie and del_cookie rather than direct dictionary assignment.

LIKELY FOLLOW-UPS: The interviewer may ask what happens to response_model when you return a Response directly versus injecting a Response parameter. They might also ask how to set headers globally, which leads to middleware or APIRoute subclasses. Another follow-up is how to handle multiple Set-Cookie headers or cookie security flags like Secure, SameSite, and HttpOnly in production.

ONE CONCRETE EXAMPLE: You could write a path operation that injects Response, sets a rate-limit header, and drops a session cookie. For instance, define login with a response parameter, set response.headers['X-RateLimit'] to 100, call response.set_cookie with key session and value token123 and httponly set to True, then return a dict with status logged_in. FastAPI merges the header and cookie into the final JSON response while still validating the returned dict against any response_model.