Everything in Backend Dev, page 31
FastAPI Lifespan: Code Before Startup, After Shutdown
FastAPI's lifespan events are "open for business" and "closing time" routines that run once before startup and after shutdown. Use them to initialize a DB pool or load a model. The footgun is putting request-specific logic here; it runs once only.
FastAPI Behind a Reverse Proxy: Fixing Docs URLs
When a proxy exposes FastAPI under a path prefix it strips before forwarding, configure that public prefix with root_path so OpenAPI and docs links use the external URL. The proxy must still route that prefix correctly.
Customizing FastAPI's Swagger UI Behavior
Treat FastAPI's Swagger UI as a configurable frontend, not a static page. You can customize its behavior by passing a dictionary of settings on app startup. This is useful for changing themes or pre-filling auth fields. The footgun: keys must be camelCase.
Exclude a FastAPI Endpoint from OpenAPI Docs
Hide an endpoint from your API docs by setting include_in_schema=False. Use this for internal or deprecated endpoints. The footgun: this only hides the endpoint from documentation; it remains fully functional and accessible if the URL is known.
FastAPI: Documenting Additional API Responses
Document every possible API response, not just the happy path. The responses decorator parameter lets you define alternative status codes and schemas, like a 404 error model, making your OpenAPI docs complete.
FastAPI: Configure API Metadata for Better Docs
Think of FastAPI metadata as your project's business card. It sets the title, version, and description in your auto-generated docs, making your API professional and discoverable. The main footgun is forgetting to update the version string after a release.
Testing WebSockets in FastAPI
Test a WebSocket conversation by scripting both sides. FastAPI's TestClient provides a websocket_connect context manager to send messages and assert responses sequentially, which is crucial for testing chats or live data feeds.
Mocking with Pytest's monkeypatch
Pytest's monkeypatch is a temporary stunt double for your code, safely swapping out functions or environment variables for a single test. Use it to isolate tests from network calls or filesystem access.
Testing Async FastAPI with pytest-asyncio
To test async code, your tests must also be async. pytest-asyncio lets you write async def test_... functions to await operations like database checks after an API call.
Run One Test with Many Inputs using pytest.parametrize
Run one test function with many inputs using @pytest.mark.parametrize, avoiding repetitive code. It's ideal for checking a function against various inputs, edge cases, and expected failures. The footgun: mutable parameters like lists are passed by reference.
pytest Fixtures: Reusable Test Setups
Pytest fixtures are reusable functions for test setup, like creating sample data. Your tests request them by name as arguments, and pytest automatically runs them and injects the results.
FastAPI's TestClient: Test Your API Without a Live Server
FastAPI's TestClient simulates API requests in-memory, letting you test endpoints without a live server. Use it with pytest to verify status codes and responses. The main footgun is forgetting to pip install httpx, as it's a required dependency.
Celery: Offloading Work from Your FastAPI App
Celery lets your web app offload slow tasks to a separate process, keeping your API responsive. Use it for tasks that can't finish in a single HTTP request, like sending bulk emails or processing images.
Custom FastAPI Middleware: The BaseHTTPMiddleware Helper
FastAPI's BaseHTTPMiddleware lets you wrap endpoints to run code before and after they execute. Use it to add custom headers or log request times. The footgun: reading request.body() in the middleware will break the endpoint, as the body can only be read…
FastAPI Background Tasks: Don't Make the Client Wait
FastAPI background tasks let you run slow operations, like sending an email, *after* returning a response. This keeps your API fast. The main footgun: these are fire-and-forget; a server crash means the task is lost without a real message queue.
CORSMiddleware: Unblocking Your Frontend from Your Backend
CORS is a browser security rule, not a server bug. Use FastAPI's CORSMiddleware to tell browsers which frontends (e.g., localhost:3000) are allowed to fetch data from your API (e.g., localhost:8000).
CSRF: Double Submit Cookies for Stateless Backends
Double Submit Cookies stop CSRF by requiring a secret in two places: a cookie and a request header. The server just checks if they match. It's useful for stateless APIs where storing server-side tokens is impractical.
OpenID Connect (OIDC): Authentication as a Service
OIDC lets you delegate user login to a trusted third party, like "Sign in with Google." Your app gets a verifiable token saying who the user is, without handling their password. It's used for SSO in web apps.
Refresh Tokens: Persistent Sessions Without Re-Authentication
A refresh token is a long-lived credential used to get a new, short-lived access token without re-authenticating. It's how apps keep you logged in for weeks. The footgun is storing it insecurely, letting attackers mint access tokens forever.
FastAPI RBAC: Using OAuth2 Scopes for Permissions
Treat OAuth2 scopes as a list of permissions. Instead of checking a user's role, you check if their token has the required scope (e.g., items:write) for an endpoint. FastAPI's Security dependency automates this check.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles