```Python hl_lines="2  6"
{!../../../docs_src/advanced_middleware/tutorial001.py!}
```

## `TrustedHostMiddleware`

Enforces that all incoming requests have a correctly set `Host` header, in order to guard against HTTP Host Header attacks.

```Python hl_lines="2  6-8"
{!../../../docs_src/advanced_middleware/tutorial002.py!}
```

The following arguments are supported:

* Add a **JSON Schema** for the response, in the OpenAPI *path operation*.
    * This will be used by the **automatic docs**.
    * It will also be used by automatic client code generation tools.

But most importantly:

* It will **limit and filter** the output data to what is defined in the return type.
    * This is particularly important for **security**, we'll see more of that below.

## `response_model` Parameter

client = TestClient(app)


def test_post_file(tmp_path):
    path = tmp_path / "test.txt"
    path.write_bytes(b"<file content>")

    client = TestClient(app)
    with path.open("rb") as file:
        response = client.post("/files/", files={"file": file})
    assert response.status_code == 200, response.text
    assert response.json() == {"file_size": 14}


def test_post_upload_file(tmp_path):

def test_body_float(client: TestClient):
    response = client.post("/items/", json={"name": "Foo", "price": 50.5})
    assert response.status_code == 200
    assert response.json() == {
        "name": "Foo",
        "price": 50.5,
        "description": None,
        "tax": None,
    }


def test_post_with_str_float(client: TestClient):
    response = client.post("/items/", json={"name": "Foo", "price": "50.5"})

def test_body_float(client: TestClient):
    response = client.post("/items/", json={"name": "Foo", "price": 50.5})
    assert response.status_code == 200
    assert response.json() == {
        "name": "Foo",
        "price": 50.5,
        "description": None,
        "tax": None,
    }


@needs_py310
def test_post_with_str_float(client: TestClient):
    response = client.post("/items/", json={"name": "Foo", "price": "50.5"})

    client = TestClient(app)
    return client


def test_post_body_form(client: TestClient):
    response = client.post("/login/", data={"username": "Foo", "password": "secret"})
    assert response.status_code == 200
    assert response.json() == {"username": "Foo"}


def test_post_body_form_no_password(client: TestClient):
    response = client.post("/login/", data={"username": "Foo"})
    assert response.status_code == 422

            "schemas": {
                "Body_create_product_products_post": {
                    "title": "Body_create_product_products_post",
                    "required": ["data"],
                    "type": "object",
                    "properties": {"data": {"$ref": "#/components/schemas/Product"}},
                },
                "Body_create_shop_shops_post": {
                    "title": "Body_create_shop_shops_post",

    pass


app = FastAPI()


@app.post("/")
async def post(
    foo: Union[Foo, None] = None,
):
    return foo


client = TestClient(app)


def test_call_invalid():
    response = client.post("/", json={"foo": {"bar": "baz"}})
    assert response.status_code == 422


def test_call_valid():
    response = client.post("/", json={})
    assert response.status_code == 200

    price: int


@app.post("/items/")
def save_union_body(item: Union[OtherItem, Item]):
    return {"item": item}


client = TestClient(app)


def test_post_other_item():
    response = client.post("/items/", json={"price": 100})
    assert response.status_code == 200, response.text
    assert response.json() == {"item": {"price": 100}}


def test_post_item():

from dirty_equals import IsDict
from fastapi.testclient import TestClient

from docs_src.handling_errors.tutorial005 import app

client = TestClient(app)


def test_post_validation_error():
    response = client.post("/items/", json={"title": "towel", "size": "XL"})
    assert response.status_code == 422, response.text
    assert response.json() == IsDict(
        {
            "detail": [
                {