Fastapi Redirection For Trailing Slash Returns Non-ssl Link

Running into an issue when we call an endpoint and a redirect occurs due to a missing trailing slash. As you can see in the image below, when a request is made to https://.../notif

Solution 1:

This is because your application isn't trusting the reverse proxy's headers overriding the scheme (the X-Forwarded-Proto header that's passed when it handles a TLS request).

There's a few ways we can fix that:

• If you're running the application straight from uvicorn server, try using the flag --forwarded-allow-ips '*'.

• If you're running gunicorn you can set as well the flag --forwarded-allow-ips="*".

• In either application, you can additionally use the FORWARDED_ALLOW_IPS environment variable.

Important: the * should be used only as a test, as it'll lead your application to trust the X-Forwarded-* headers from any source. I suggest you read uvicorn's docs and gunicorn's docs for a deeper knowledge of what to set in this flag and why.

Solution 2:

I experienced this issue when using FastAPI with react-admin.

One workaround is to change FastAPI app so it doesn't make redirects, but treats both URLs as valid API endpoints (with and without slash).

You can use this snippet wrote by malthunayan to change behaviour of APIRouter:

from typing importAny, Callablefrom fastapi import APIRouter as FastAPIRouter
from fastapi.types import DecoratedCallable


classAPIRouter(FastAPIRouter):
    defapi_route(
        self, path: str, *, include_in_schema: bool = True, **kwargs: Any) -> Callable[[DecoratedCallable], DecoratedCallable]:
        if path.endswith("/"):
            path = path[:-1]

        add_path = super().api_route(
            path, include_in_schema=include_in_schema, **kwargs
        )

        alternate_path = path + "/"
        add_alternate_path = super().api_route(
            alternate_path, include_in_schema=False, **kwargs
        )

        defdecorator(func: DecoratedCallable) -> DecoratedCallable:
            add_alternate_path(func)
            return add_path(func)

        return decorator

source: https://github.com/tiangolo/fastapi/issues/2060#issuecomment-834868906

(you can also see other similar solutions in this GitHub issue)

---

Another workaround is to add:

<metahttp-equiv="Content-Security-Policy"content="upgrade-insecure-requests">

to index.html file in frontend. It will upgrade all requests from http to https (also when run locally, so it may not be the best workaround)