البرمجيات الوسيطة وCORS والملاحظة

import re
from fastapi import FastAPI, Request
from fastapi.testclient import TestClient
app = FastAPI()
@app.middleware("http")
async def correlation(request: Request, call_next):
    candidate = request.headers.get("X-Request-ID", "")
    request.state.request_id = candidate if re.fullmatch(r"[a-z0-9-]{1,40}", candidate) else "lab-generated"
    response = await call_next(request)
    response.headers["X-Request-ID"] = request.state.request_id
    return response
@app.get("/health")
def health(): return {"ok": True}
with TestClient(app) as client:
    print(client.get("/health", headers={"X-Request-ID": "lab-a"}).headers["X-Request-ID"])
    print(client.get("/health", headers={"X-Request-ID": "x" * 80}).headers["X-Request-ID"])

lab-a
lab-generated

يرد القصير ويستبدل الطويل ببديل اصطناعي ثابت، ويحتاج توليد الإنتاج سياسة ولا يمنح الربط هوية.

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from fastapi.testclient import TestClient
app = FastAPI()
app.add_middleware(CORSMiddleware, allow_origins=["https://client.example.invalid"], allow_credentials=True, allow_methods=["GET"], allow_headers=["X-Lab"])
@app.get("/resource")
def resource(): return {"public": True}
with TestClient(app) as client:
    allowed = client.options("/resource", headers={"Origin": "https://client.example.invalid", "Access-Control-Request-Method": "GET"})
    denied = client.options("/resource", headers={"Origin": "https://other.example.invalid", "Access-Control-Request-Method": "GET"})
    direct = client.get("/resource", headers={"Origin": "https://other.example.invalid"})
    print(allowed.status_code, allowed.headers["access-control-allow-origin"])
    print(denied.status_code)
    print(direct.status_code, direct.headers.get("access-control-allow-origin"))

200 https://client.example.invalid
400
200 None

ينجح preflight المسموح ويرفض الآخر 400، وتبقى GET200 بلا سماح لتبين أن CORS ليست إذن خادم.