} catch (XMLStreamException e) {
            throw new ToolchainsParseException(
                    e.getMessage(),
                    e.getLocation().getLineNumber(),
                    e.getLocation().getColumnNumber(),
                    e);
        }
    }

    private boolean isStrict(Map<String, ?> options) {

        Object value = (options != null) ? options.get(IS_STRICT) : null;
        return value == null || Boolean.parseBoolean(value.toString());
    }

    private InputSource getSource(Map<String, ?> options) {
        Object value = (options != null) ? options.get(INPUT_SOURCE) : null;
        return (InputSource) value;
    }

            this.transformer = transformer;
            return this;
        }

        public XmlReaderRequestBuilder strict(boolean strict) {
            this.strict = strict;
            return this;
        }

        public XmlReaderRequestBuilder modelId(String modelId) {
            this.modelId = modelId;
            return this;
        }

@Deprecated(since = "4.0.0")
public interface SettingsReader {

    /**
     * The key for the option to enable strict parsing. This option is of type {@link Boolean} and defaults to {@code
     * true}. If {@code false}, unknown elements will be ignored instead of causing a failure.
     */
    String IS_STRICT = "org.apache.maven.settings.io.isStrict";

    /**
     * Reads the settings from the specified file.
     *

@Deprecated(since = "4.0.0")
public interface ToolchainsReader {

    /**
     * The key for the option to enable strict parsing. This option is of type {@link Boolean} and defaults to {@code
     * true}. If {@code false}, unknown elements will be ignored instead of causing a failure.
     */
    String IS_STRICT = "org.apache.maven.toolchains.io.isStrict";

    /**
     * Reads the toolchains from the specified file.
     *

 *
 */
public interface MetadataReader {

    /**
     * The key for the option to enable strict parsing. This option is of type {@link Boolean} and defaults to {@code
     * true}. If {@code false}, unknown elements will be ignored instead of causing a failure.
     */
    String IS_STRICT = "org.apache.maven.artifact.repository.metadata.io.isStrict";

    /**
     * Reads the metadata from the specified file.
     *

s","i","push","extend","valueOf","createUTC","format","locale","strict","createLocalOrUTC","utc","getParsingFlags","m","_pf","empty","unusedTokens","unusedInput","overflow","charsLeftOver","nullInput","invalidEra","invalidMonth","invalidFormat","userInvalidated","iso","parsedDateParts","era","meridiem","rfc2822","weekdayMismatch","isValid","_isValid","flags","parsedParts","isNowValid","isNaN","_d","getTime","invalidWeekday","_strict","undefined","bigHour","isFrozen","createInvalid","NaN","fun","...

# 严格的 Content-Type 检查 { #strict-content-type-checking }

默认情况下，FastAPI 对 JSON 请求体使用严格的 `Content-Type` 头检查。这意味着，JSON 请求必须包含有效的 `Content-Type` 头（例如 `application/json`），其请求体才会被按 JSON 解析。

## CSRF 风险 { #csrf-risk }

此默认行为在一个非常特定的场景下，可防御一类跨站请求伪造（CSRF）攻击。

这类攻击利用了浏览器的一个事实：当请求满足以下条件时，浏览器允许脚本在不进行任何 CORS 预检的情况下直接发送请求：

- 没有 `Content-Type` 头（例如使用 `fetch()` 携带 `Blob` 作为 body）
- 且不发送任何认证凭据。

这种攻击主要在以下情况下相关：

- 应用在本地（如 `localhost`）或内网中运行

# Strict Content-Type Checking { #strict-content-type-checking }

By default, **FastAPI** uses strict `Content-Type` header checking for JSON request bodies, this means that JSON requests **must** include a valid `Content-Type` header (e.g. `application/json`) in order for the body to be parsed as JSON.

## CSRF Risk { #csrf-risk }

This default behavior provides protection against a class of **Cross-Site Request Forgery (CSRF)** attacks in a very specific scenario.

# Sıkı Content-Type Kontrolü { #strict-content-type-checking }

Varsayılan olarak FastAPI, JSON request body'leri için sıkı Content-Type header kontrolü uygular. Bu, JSON request'lerin body'lerinin JSON olarak parse edilebilmesi için geçerli bir Content-Type header'ı (örn. application/json) içermesi gerektiği anlamına gelir.

## CSRF Riski { #csrf-risk }