Mark Theunissen <******@****.***> 1740597949 +0100

# Behind a Proxy { #behind-a-proxy }

In many situations, you would use a **proxy** like Traefik or Nginx in front of your FastAPI app.

These proxies could handle HTTPS certificates and other things.

## Proxy Forwarded Headers { #proxy-forwarded-headers }

```mermaid
sequenceDiagram
    participant Client
    participant Proxy as Proxy/Loadbalancer
    participant Server as FastAPI Server

    Client->>Proxy: HTTPS-Request<br/>Host: mysuperapp.com<br/>Pfad: /items

    Note over Proxy: Proxy fügt Forwarded-Header hinzu

```mermaid
sequenceDiagram
    participant Client
    participant Proxy as Proxy/Load Balancer
    participant Server as FastAPI Server

    Client->>Proxy: HTTPS Request<br/>Host: mysuperapp.com<br/>Path: /items

    Note over Proxy: Proxy adds forwarded headers

```mermaid
sequenceDiagram
    participant Client as Cliente
    participant Proxy as Proxy/Load Balancer
    participant Server as Servidor de FastAPI

    Client->>Proxy: HTTPS Request<br/>Host: mysuperapp.com<br/>Path: /items

    Note over Proxy: El proxy añade headers reenviados

```mermaid
sequenceDiagram
    participant Client as Клиент
    participant Proxy as Прокси/Балансировщик нагрузки
    participant Server as FastAPI-сервер

    Client->>Proxy: HTTPS-запрос<br/>Host: mysuperapp.com<br/>Path: /items

    Note over Proxy: Прокси-сервер добавляет пересылаемые заголовки

    private const val PROXY_A_HOST = "proxya"
    private val proxyA =
      Proxy(
        Proxy.Type.HTTP,
        InetSocketAddress.createUnresolved(PROXY_A_HOST, PROXY_A_PORT),
      )

    private const val PROXY_B_PORT = 1002
    private const val PROXY_B_HOST = "proxyb"
    private val proxyB =
      Proxy(
        Proxy.Type.HTTP,

    }

    return Selection(routes)
  }

  /** Prepares the proxy servers to try. */
  private fun resetNextProxy(
    url: HttpUrl,
    proxy: Proxy?,
  ) {
    fun selectProxies(): List<Proxy> {
      // If the user specifies a proxy, try that and only that.
      if (proxy != null) return listOf(proxy)

      // If the URI lacks a host (as in "http://</"), don't call the ProxySelector.

                    }

                    Proxy p = new Proxy();
                    p.setHost(proxy.getHost());
                    p.setProtocol(proxy.getProtocol());
                    p.setPort(proxy.getPort());
                    p.setNonProxyHosts(proxy.getNonProxyHosts());
                    p.setUserName(proxy.getUsername());
                    p.setPassword(proxy.getPassword());

Todo este proceso de renovación, mientras aún se sirve la aplicación, es una de las principales razones por las que querrías tener un **sistema separado para gestionar el HTTPS** con un TLS Termination Proxy en lugar de simplemente usar los certificados TLS con el servidor de aplicaciones directamente (por ejemplo, Uvicorn).

## Headers reenviados por el proxy { #proxy-forwarded-headers }