How does middleware work in FastAPI?

Question

IT Interview Practice · Accepted Answer

**Middleware** in FastAPI is code that runs for **every request and response** — wrapping your endpoints to handle cross-cutting concerns like logging, timing, CORS, and adding headers. FastAPI uses Starlette's middleware system (it's ASGI-based).

## Writing custom middleware

```python
import time

@app.middleware("http")
async def add_timing(request: Request, call_next):
    start = time.time()
    response = await call_next(request)        # call the endpoint (and any inner middleware)
    response.headers["X-Process-Time"] = str(time.time() - start)   # modify the response
    return response
```

The pattern: code before `await call_next(request)` runs on the way **in** (before the endpoint), `call_next` invokes the endpoint, and code after runs on the way **out** (modifying the response). This wraps every request — here, adding a timing header to all responses.

## The request/response flow

```text
Request  → MW1 → MW2 → endpoint
Response ← MW1 ← MW2 ← endpoint
Middleware wraps the endpoint; runs in order on the way in, reverse on the way out.
```

## Built-in / common middleware

```python
from fastapi.middleware.cors import CORSMiddleware
from fastapi.middleware.gzip import GZipMiddleware

app.add_middleware(CORSMiddleware, allow_origins=["https://app.example.com"], ...)  # CORS
app.add_middleware(GZipMiddleware, minimum_size=1000)                               # compression
```

Middleware is commonly added via `add_middleware` — CORS (allow cross-origin requests), GZip (compress responses), and trusted-host checks are typical built-ins.

## Common middleware uses

```text
✓ Logging / request timing / metrics
✓ CORS (cross-origin request handling)
✓ Adding security or custom headers
✓ Response compression (GZip)
✓ Request ID / correlation ID injection
```

## Middleware vs dependencies

```text
Middleware   → runs for ALL requests; works at the raw request/response level (headers,
               timing, the whole response). Best for truly global concerns.
Dependencies → per-endpoint (or grouped) logic with access to parsed params, DI, and
               typed values. Best for auth, validation, shared parameters.
→ Use middleware for global cross-cutting concerns; dependencies for endpoint logic.
```

## Why it matters

Middleware is the right mechanism for **global, cross-cutting concerns** in FastAPI — logic that should apply to every request and response, like logging, request timing, CORS, compression, and custom headers.

Understanding it is important for structuring applications correctly: middleware wraps all endpoints (running before and after, with the ability to modify both request and response), making it ideal for app-wide behavior that would be tedious and error-prone to repeat in every endpoint.

Knowing the distinction between **middleware** (global, raw request/response level) and **dependencies** (per-endpoint, with access to parsed/typed values and DI — better for auth and validation) is key to choosing the right tool.

Common needs like CORS and compression are handled by built-in middleware, while custom middleware covers logging and instrumentation — making this practical, frequently-used knowledge for building well-structured, observable APIs.

Writing custom middleware

The request/response flow

Built-in / common middleware

Common middleware uses

Middleware vs dependencies

Why it matters

Related questions