Middleware — runs before/after every request

Wrap the entire app. Each request passes through before reaching the route, response passes through after.

main.py v3.1

import time
from fastapi import FastAPI, Request

app = FastAPI()

# Timing middleware — adds X-Process-Time header
@app.middleware('http')
async def timing(request: Request, call_next):
    t0 = time.perf_counter()
    # call_next runs the actual route handler
    response = await call_next(request)
    elapsed_ms = (time.perf_counter() - t0) * 1000
    response.headers['X-Process-Time'] = f'{elapsed_ms:.1f}ms'
    return response

# Security headers middleware
@app.middleware('http')
async def security_headers(request: Request, call_next):
    response = await call_next(request)
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    return response

# Logging middleware
@app.middleware('http')
async def logging_middleware(request: Request, call_next):
    print(f'-> {request.method} {request.url.path}')
    response = await call_next(request)
    print(f'<- {response.status_code}')
    return response

# Order of execution: LAST added middleware runs FIRST on the way in,
# LAST on the way out. So for the request above:
#   -> logging (added last)
#     -> security_headers
#       -> timing
#         -> actual route
#       <- timing (sets X-Process-Time)
#     <- security_headers (sets X-Frame-Options)
#   <- logging (logs status)

@app.get('/')
async def root():
    return {'message': 'Hello'}
# Response headers include X-Process-Time, X-Frame-Options, X-Content-Type-Options

API simulator click Simulate

Click "Simulate" to see what this FastAPI app does.

🧠 How it works

@app.middleware('http') — registers a middleware. Signature: async def(request, call_next). call_next(request) — runs the next middleware (or the route if you're last). Returns the response. Code BEFORE call_next runs on the way IN (request). Code AFTER call_next runs on the way OUT (response). ORDER: the LAST-added middleware runs FIRST on the request, LAST on the response (onion layers). Use cases: timing, security headers, CORS, GZip compression, logging, rate limiting, auth checks. CORS middleware is special — added with app.add_middleware(CORSMiddleware, ...) instead of the decorator. Middleware runs for EVERY request — keep it fast (no DB queries, no slow I/O).

✏️ Try these changes

Change the timing log to print only if elapsed > 100ms
→ only log slow requests
Add a new middleware that sets Cache-Control: no-store
→ prevents browser caching
Add a middleware that blocks requests with User-Agent containing 'bot'
→ anti-bot
Change X-Frame-Options from 'DENY' to 'SAMEORIGIN'
→ allows framing from same domain

← Previous lab

WebSocket — real-time bidirectional