fastapi 0.141.1: middleware.cors.CORSMiddleware

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify fastapi.middleware.cors.CORSMiddleware in pkg:pypi/fastapi@0.141.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/fastapi@0.141.1
Demonstrate these symbols/APIs:
  - fastapi.middleware.cors.CORSMiddleware

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8429618a1034ba7953a013e4c744bd61785ea51d4cf0a192a7de143e7e47eaa6","contract":["assert CORSMiddleware adds access-control-allow-origin and credentials headers for allowed origin simple requests","assert CORSMiddleware responds to preflight OPTIONS requests with allowed methods, headers, and max-age","assert CORSMiddleware rejects preflight requests from disallowed origins with status 400","assert CORSMiddleware supports regex origin matching via allow_origin_regex","assert non-CORS requests without origin header pass through without CORS response headers"],"goal":"verify fastapi.middleware.cors.CORSMiddleware in pkg:pypi/fastapi@0.141.1","kind":"HOW","packages":["pkg:pypi/fastapi@0.141.1"],"schemaVersion":1,"symbols":["fastapi.middleware.cors.CORSMiddleware"]},"contractCommand":["python3","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"pip","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/fastapi@0.141.1"],"schemaVersion":1,"subject":"pkg:pypi/fastapi@0.141.1","symbols":["fastapi.middleware.cors.CORSMiddleware"],"verifierAdapter":"python@1"}

[project]
name = "verify-fastapi-cors"
version = "0.1.0"
dependencies = [
    "fastapi==0.141.1",
]

annotated-doc==0.0.5
annotated-types==0.8.0
anyio==4.14.2
fastapi==0.141.1
idna==3.19
pydantic==2.13.4
pydantic-core==2.46.4
starlette==1.6.0
typing-extensions==4.16.0
typing-inspection==0.4.4

{
  "schemaVersion": 1,
  "goal": "verify fastapi.middleware.cors.CORSMiddleware in pkg:pypi/fastapi@0.141.1",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/fastapi@0.141.1"
  ],
  "symbols": [
    "fastapi.middleware.cors.CORSMiddleware"
  ]
}

import asyncio
from typing import Dict, List, Tuple
from fastapi import FastAPI
from fastapi.responses import PlainTextResponse
from fastapi.middleware.cors import CORSMiddleware


async def make_asgi_request(
    app,
    method: str,
    path: str,
    headers: List[Tuple[bytes, bytes]],
) -> Tuple[int, Dict[str, str], bytes]:
    response_status = 0
    response_headers: Dict[str, str] = {}
    response_body = bytearray()

    scope = {
        "type": "http",
        "asgi": {"version": "3.0", "spec_version": "2.0"},
        "http_version": "1.1",
        "method": method,
        "path": path,
        "raw_path": path.encode("latin-1"),
        "query_string": b"",
        "headers": headers,
        "client": ("127.0.0.1", 12345),
        "server": ("127.0.0.1", 80),
        "scheme": "http",
    }

    async def receive():
        return {"type": "http.request", "body": b"", "more_body": False}

    async def send(message):
        nonlocal response_status, response_headers, response_body
        if message["type"] == "http.response.start":
            response_status = message["status"]
            for name, value in message.get("headers", []):
                response_headers[name.decode("latin-1").lower()] = value.decode("latin-1")
        elif message["type"] == "http.response.body":
            response_body.extend(message.get("body", b""))

    await app(scope, receive, send)
    return response_status, response_headers, bytes(response_body)


def build_test_app() -> FastAPI:
    app = FastAPI()
    app.add_middleware(
        CORSMiddleware,
        allow_origins=["https://example.com"],
        allow_credentials=True,
        allow_methods=["GET", "POST"],
        allow_headers=["x-custom-header"],
        expose_headers=["x-response-id"],
        max_age=600,
    )

    @app.get("/items")
    def get_items():
        return PlainTextResponse("sample items", headers={"X-Response-Id": "resp-999"})

    @app.post("/items")
    def post_items():
        return PlainTextResponse("item created")

    return app


def test_cors_simple_request_allowed_origin():
    app = build_test_app()
    headers = [
        (b"origin", b"https://example.com"),
    ]
    status, res_headers, body = asyncio.run(make_asgi_request(app, "GET", "/items", headers))
    assert status == 200
    assert body == b"sample items"
    assert res_headers.get("access-control-allow-origin") == "https://example.com"
    assert res_headers.get("access-control-allow-credentials") == "true"
    assert "x-response-id" in res_headers.get("access-control-expose-headers", "").lower()


def test_cors_preflight_allowed_origin():
    app = build_test_app()
    headers = [
        (b"origin", b"https://example.com"),
        (b"access-control-request-method", b"POST"),
        (b"access-control-request-headers", b"x-custom-header"),
    ]
    status, res_headers, body = asyncio.run(make_asgi_request(app, "OPTIONS", "/items", headers))
    assert status == 200
    assert body == b"OK"
    assert res_headers.get("access-control-allow-origin") == "https://example.com"
    assert "POST" in res_headers.get("access-control-allow-methods", "")
    assert "x-custom-header" in res_headers.get("access-control-allow-headers", "").lower()
    assert res_headers.get("access-control-max-age") == "600"
    assert res_headers.get("access-control-allow-credentials") == "true"


def test_cors_preflight_disallowed_origin():
    app = build_test_app()
    headers = [
        (b"origin", b"https://disallowed.example.com"),
        (b"access-control-request-method", b"POST"),
    ]
    status, res_headers, body = asyncio.run(make_asgi_request(app, "OPTIONS", "/items", headers))
    assert status == 400
    assert b"Disallowed CORS origin" in body
    assert "access-control-allow-origin" not in res_headers


def test_cors_regex_origin_matching():
    regex_app = FastAPI()
    regex_app.add_middleware(
        CORSMiddleware,
        allow_origin_regex=r"https://.*\.example\.com",
        allow_methods=["GET"],
    )

    @regex_app.get("/data")
    def get_data():
        return PlainTextResponse("regex data")

    allowed_headers = [(b"origin", b"https://api.example.com")]
    status, res_headers, body = asyncio.run(make_asgi_request(regex_app, "GET", "/data", allowed_headers))
    assert status == 200
    assert res_headers.get("access-control-allow-origin") == "https://api.example.com"

    disallowed_headers = [(b"origin", b"http://unmatched.example.com")]
    status_disallowed, res_headers_disallowed, _ = asyncio.run(
        make_asgi_request(regex_app, "GET", "/data", disallowed_headers)
    )
    assert status_disallowed == 200
    assert "access-control-allow-origin" not in res_headers_disallowed


def test_cors_non_cors_request_passthrough():
    app = build_test_app()
    headers = []
    status, res_headers, body = asyncio.run(make_asgi_request(app, "GET", "/items", headers))
    assert status == 200
    assert body == b"sample items"
    assert "access-control-allow-origin" not in res_headers
    assert "access-control-allow-credentials" not in res_headers


def main():
    test_cors_simple_request_allowed_origin()
    test_cors_preflight_allowed_origin()
    test_cors_preflight_disallowed_origin()
    test_cors_regex_origin_matching()
    test_cors_non_cors_request_passthrough()
    print("All contract assertions passed.")


if __name__ == "__main__":
    main()