Piye carane ngatur CORS ing FastAPI?

Question

Accepted Answer

**CORS** (Cross-Origin Resource Sharing) yaiku mekanisme keamanan browser sing ngontrol apa halaman web saka siji **origin** bisa manggil API mu ing origin liyane. FastAPI ngaturé nganggo **`CORSMiddleware`** sing wis dibangun. Sampéyan bakal ketemu CORS saben-saben frontend ing domain/port beda manggil API mu.

## Masalah sing ditangani CORS

```text
A React app at http://localhost:3000 calling an API at http://localhost:8000 is
CROSS-ORIGIN (different port). The BROWSER blocks the response unless the API
sends CORS headers permitting that origin.
(origin = scheme + host + port)
```

## Panamaan CORSMiddleware

```python
from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com", "http://localhost:3000"],  # ALLOWLIST of origins
    allow_credentials=True,         # allow cookies/auth (requires specific origins, not "*")
    allow_methods=["*"],             # or ["GET", "POST", ...]
    allow_headers=["*"],
)
```

Middleware nambahake header respons CORS sing diperlukan, ngandhani browser origin, metode, lan header mana sing diperbolehke. Browser ngenforske aturan-aturan kasebut.

## Keamanan: wateske origin (aja nggunakake "*")

```python
# ❌ allowing all origins — convenient but insecure for credentialed/private APIs
allow_origins=["*"]
# ✅ restrict to your known frontend origins (an allowlist)
allow_origins=["https://app.example.com"]
# NOTE: allow_credentials=True is INCOMPATIBLE with allow_origins=["*"]
```

Untuk produksi, **wateske `allow_origins` menyang daftar pengecualian** banjur saka `*`. Uga, ngidini kredensial (cookies/auth) butuh origin spesifik — wildcard ora diperbolehke karo kredensial.

## Anggapan salah sing penting

```text
CORS is enforced by the BROWSER, not the server. It does NOT protect your API from
non-browser clients (curl, Postman, other servers) — those ignore CORS entirely.
CORS only governs what browser JavaScript from other origins may do.
```

## Mengapa iki penting

CORS yaiku salah siji saka keributan paling umum ing pangembangan web — meh saben susunan frontend-ke-API ketemu (utamane ing pangembangan lokal karo port beda, lan ing produksi karo domain frontend kapisah), mula ngerti carane ngaturé karo `CORSMiddleware` FastAPI yaiku ilmu praktis sing asring dibutuhke.

Ngreti *mengapa* iku ana (keamanan same-origin browser), piye carane server setuju liwat header respons, lan carane ngaturé (origin sing diperbolehke, metode, header, kredensial) iku perlu kanggo sambung frontend menyang API FastAPI tanpa pranyata sing katokan.

Sama penting yaiku ngaturé **kanthi aman** — wateske `allow_origins` menyang daftar pengecualian spesifik tinimbang `*` sing permisif (lan ngreti yen kredensial ora cocog karo wildcard) — lan mahami anggapan salah sing penting yen **CORS yaiku mekanisme browser, ora otorisasi API** (iku ora nglindungi saka klien non-browser).

Ngerti carane nyiyapke CORS kanthi bener lan aman yaiku ilmu penting saben-dina kanggo apa-apa API FastAPI sing dikonsumsi dening frontend web.