Yaya ake saita CORS a FastAPI?

Question

Accepted Answer

**CORS** (Cross-Origin Resource Sharing) jiya tsarin tsaro na browser wanda yake sarrafa ko shafin jiya daga **origin** guda zai iya kira FastAPI API jiya gida. FastAPI ke saita shi tare da **`CORSMiddleware`** da aka gina. Kika ce wa CORS duk lokacin da frontend akan ninkka daban/port daban ke kira API jinka.

## Matsalar da CORS ke magance

```text
A React app at http://localhost:3000 calling an API at http://localhost:8000 is
CROSS-ORIGIN (different port). The BROWSER blocks the response unless the API
sends CORS headers permitting that origin.
(origin = scheme + host + port)
```

## Saita CORSMiddleware

```python
from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com", "http://localhost:3000"],  # ALLOWLIST of origins
    allow_credentials=True,         # allow cookies/auth (requires specific origins, not "*")
    allow_methods=["*"],             # or ["GET", "POST", ...]
    allow_headers=["*"],
)
```

Middleware yana ƙara headers ɗin CORS ɗin amsa da suke bukatar, yana gaya wa browser waɗanda origins, methods, da headers ke halatta. Browser yana karfafa waɗannan ƙaidodi.

## Tsaro: ƙunshi origins (kada ka yi amfani da "*")

```python
# ❌ allowing all origins — convenient but insecure for credentialed/private APIs
allow_origins=["*"]
# ✅ restrict to your known frontend origins (an allowlist)
allow_origins=["https://app.example.com"]
# NOTE: allow_credentials=True is INCOMPATIBLE with allow_origins=["*"]
```

Don karni, **ƙunshi `allow_origins` zuwa allowlist a maimakon `*`**. Hakanan, halatta credentials (cookies/auth) yana buƙatar origins na musamman — wildcard ba zai halatta ba tare da credentials ba.

## Gaskiya maɓalli mai mahimmanci

```text
CORS is enforced by the BROWSER, not the server. It does NOT protect your API from
non-browser clients (curl, Postman, other servers) — those ignore CORS entirely.
CORS only governs what browser JavaScript from other origins may do.
```

## Dalilin da yake da mahimmanci

CORS shine ɗaya daga cikin mahimman abubuwan da aka makanta a haɓakar web — kusan kowane saiti na frontend-to-API ke bugi shi (musamman a cikin haɓaka na gida tare da ports daban-daban, da a karni tare da yankin frontend daban), saboda haka sanin yaya ake saita shi tare da `CORSMiddleware` na FastAPI jiya ilmi mai amfani, sanin da ake buƙata a yau-yau.
"Sanin dalilin da yake da shi (tsaro na same-origin na browser), yaya server ke sumar shi ta hanyar response headers, da yaya ake saita shi (allowed origins, methods, headers, credentials) jiya aiki da ke bukatar don haɗa frontends zuwa FastAPI APIs ba tare da bubuwan da aka toshe ba.
\'Yanzu dai, gida mahimmanci ne a saita shi **cikin tsaro** — ƙunshi `allow_origins` zuwa allowlist na musamman a maimakon ruwan `*` (da sanin cewa credentials ba zai yi daidai ba tare da wildcard ba) — da fahimtar gaskiya mai mahimmanci cewa **CORS jiya jiya na browser, ba authorization na API ba** (ba ya karya raƙa daga clients ɗin ba-browser).

Sanin yaya ake saita CORS daidai da saida a cikin tsaro jiya mahimman ilmi na kwajenji kwajenji ga kowane FastAPI API da jiya frontend ke yi amfani dashi.