script.setAttribute("data-modal-title", "FastAPI AI Assistant");
  script.setAttribute("data-modal-title-color", "#FFFFFF");
  script.setAttribute("data-modal-title-font-family", "Roboto, sans-serif");
  script.setAttribute("data-modal-example-questions", "How to define a route?,How to validate models?,How to handle responses?,How to deploy FastAPI?");

Are you tired of all that **data validation**, **documentation**, **serialization**, and all that **boring** stuff?

Do you just want to **vibe**? 🎶

**FastAPI** now supports a new `@app.vibe()` decorator that embraces **modern AI coding best practices**. 🤖

## How It Works { #how-it-works }

The `@app.vibe()` decorator is intended to receive **any HTTP method** (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`, etc.) and **any payload**.

- 应用在本地（如 `localhost`）或内网中运行
- 且应用没有任何认证，假定来自同一网络的请求都可信。

## 攻击示例 { #example-attack }

假设你构建了一个本地运行的 AI 代理。

它提供了一个 API，地址为

```
http://localhost:8000/v1/agents/multivac
```

另有一个前端，地址为

```
http://localhost:8000
```

/// tip | 提示

注意它们的主机相同。

///

之后，你可以通过前端让该 AI 代理替你执行操作。

由于它在本地运行、而非暴露在开放的互联网，你决定不配置任何认证，只信任对本地网络的访问。

于是，你的某位用户安装并在本地运行了它。

然后他（她）可能会打开一个恶意网站，例如

  stars: 34997
  owner_login: mouredev
  owner_html_url: https://github.com/mouredev
- name: serve
  html_url: https://github.com/jina-ai/serve
  stars: 21857
  owner_login: jina-ai
  owner_html_url: https://github.com/jina-ai
- name: HivisionIDPhotos
  html_url: https://github.com/Zeyi-Lin/HivisionIDPhotos
  stars: 20868
  owner_login: Zeyi-Lin
  owner_html_url: https://github.com/Zeyi-Lin

labels.chat_error_service_unavailable=The AI service is temporarily unavailable. Please try again later.
labels.chat_error_timeout=The request timed out. Please try again.
labels.chat_error_context_length_exceeded=The message is too long to process. Please shorten it and try again.
labels.chat_error_model_not_found=The AI model was not found. Please contact the administrator.
labels.chat_error_invalid_response=Received an invalid response from the AI service. Please try again.

- 並且應用沒有任何身分驗證，假設同一個網路中的任何請求都可被信任

## 攻擊範例 { #example-attack }

假設你打造了一個在本機執行 AI 代理（AI agent）的方法。

它提供一個 API：

```
http://localhost:8000/v1/agents/multivac
```

同時也有一個前端：

```
http://localhost:8000
```

/// tip | 提示

請注意兩者的主機（host）相同。

///

接著你可以透過前端讓 AI 代理代你執行動作。

由於它在本機執行、而非公開的網際網路上，你決定不設定任何身分驗證，只信任對本機網路的存取。

然後你的某位使用者可能安裝並在本機執行它。

## Example Attack { #example-attack }

Imagine you build a way to run a local AI agent.

It provides an API at

```
http://localhost:8000/v1/agents/multivac
```

There's also a frontend at

```
http://localhost:8000
```

/// tip

Note that both have the same host.

///

Then using the frontend you can make the AI agent do things on your behalf.

labels.chat_error_service_unavailable=The AI service is temporarily unavailable. Please try again later.
labels.chat_error_timeout=The request timed out. Please try again.
labels.chat_error_context_length_exceeded=The message is too long to process. Please shorten it and try again.
labels.chat_error_model_not_found=The AI model was not found. Please contact the administrator.
labels.chat_error_invalid_response=Received an invalid response from the AI service. Please try again.

- かつ、アプリに認証がなく、同一ネットワークからのリクエストは信頼できると想定している

## 攻撃例 { #example-attack }

ローカルで AI エージェントを実行できる仕組みを構築したとします。

それは次の API を提供します。

```
http://localhost:8000/v1/agents/multivac
```

フロントエンドもあります。

```
http://localhost:8000
```

/// tip | 豆知識

両方とも同じホストであることに注意してください。

///

そのフロントエンドを使って、AI エージェントに自分の代わりに作業をさせられます。

.teamcity/.mvn/.develocity/
/discoclient.properties

# Ignore local configuration files for asdf, allowing the JDK to be configured for project (https://asdf-vm.com)
.tool-versions

# AI 
# ---
.claude/CLAUDE.local.md
.claude/settings.local.json