# 엄격한 Content-Type 확인 { #strict-content-type-checking }

기본적으로 **FastAPI**는 JSON 요청 본문에 대해 엄격한 `Content-Type` 헤더 검사를 사용합니다. 이는 JSON 요청의 본문을 JSON으로 파싱하려면 유효한 `Content-Type` 헤더(예: `application/json`)를 반드시 포함해야 함을 의미합니다.

## CSRF 위험 { #csrf-risk }

이 기본 동작은 매우 특정한 시나리오에서 **Cross-Site Request Forgery (CSRF)** 공격의 한 유형에 대한 보호를 제공합니다.

이러한 공격은 브라우저가 다음과 같은 경우 CORS 사전 요청(preflight) 검사를 수행하지 않고 스크립트가 요청을 보내도록 허용한다는 점을 악용합니다:

# Content-Type の厳格チェック { #strict-content-type-checking }

既定では、FastAPI は JSON リクエストボディに対して厳格な `Content-Type` ヘッダーのチェックを行います。つまり、JSON のリクエストを JSON として解析するには、有効な `Content-Type` ヘッダー（例: `application/json`）を必ず含める必要があります。

## CSRF のリスク { #csrf-risk }

この既定の挙動は、ある特定の状況における Cross-Site Request Forgery（CSRF）攻撃の一種に対する保護を提供します。

これらの攻撃は、次の条件を満たすときにブラウザが CORS のプリフライトチェックを行わずにスクリプトからリクエストを送信できる事実を悪用します。

- `Content-Type` ヘッダーがない（例: `Blob` をボディにして `fetch()` を使う）

        // Manual implementation (for comparison)
        QueryBuilder result2;
        context2.addFieldLog("title", "test");
        context2.addHighlightedQuery("test");
        if (Constants.DEFAULT_FIELD.equals("title")) {
            result2 = queryCommand.buildDefaultQueryBuilder(fessConfig, context2,
                    (field, boost) -> QueryBuilders.matchQuery(field, "test").boost(boost));

        DirectoryLeaseContext context = new DirectoryLeaseContext(key, leaseState, scope);

        assertEquals(key, context.getLeaseKey());
        assertEquals(leaseState, context.getLeaseState());
        assertEquals(scope, context.getCacheScope());
        assertEquals(30000L, context.getMaxCacheAge());
        assertTrue(context.isNotificationEnabled());
        assertEquals(0, context.getNotificationFilter());
    }

That will merge the `.md` files in `next` into a single file.
Atomically (as close to it as possible) add that file to `_content/doc` directory
of the website repository and remove the `doc/next` directory in this repository.

To begin the next release development cycle, populate the contents of `next`
with those of `initial`. From the repo root:

    > cd doc
    > cp -R initial/ next

    val expected =
      """
      |--AaB03x
      |Content-Disposition: form-data; name="submit-name"
      |
      |Larry
      |--AaB03x
      |Content-Disposition: form-data; name="files"
      |Content-Type: multipart/mixed; boundary=BbC04y
      |
      |--BbC04y
      |Content-Disposition: file; filename="file1.txt"
      |Content-Type: text/plain; charset=utf-8
      |

		}
		content.Key = s3EncodeName(object.Name, encodingType)
		content.LastModified = amztime.ISO8601Format(object.ModTime.UTC())
		if object.ETag != "" {
			content.ETag = "\"" + object.ETag + "\""
		}
		content.Size = object.Size
		if object.StorageClass != "" {
			content.StorageClass = filterStorageClass(ctx, object.StorageClass)
		} else {
			content.StorageClass = globalMinioDefaultStorageClass
		}
		content.Owner = owner

        assertFileExistence(dir, filename, true);

        File file = new File(dir, filename);

        String contents = FileUtils.fileRead(file, encoding);

        assertEquals(contentsTest, contents);
    }

    public File createFile(File dir, String filename, String contents, String encoding) throws IOException {
        File file = new File(dir, filename);

        file.getParentFile().mkdirs();

    }

    /**
     * Retrieves the XML content as an {@link InputStream} using the platform's default encoding.
     *
     * @param contents
     *            The content. Must not be {@literal null}.
     * @return {@link InputStream}
     */
    public static InputStream getContentsAsStream(final String contents) {
        assertArgumentNotNull("contents", contents);
        return getContentsAsStream(contents, null);
    }

 *
 * @author Jared Levy
 */
@GwtIncompatible
@J2ktIncompatible
final class Serialization {
  private Serialization() {}

  /**
   * Stores the contents of a map in an output stream, as part of serialization. It does not support
   * concurrent maps whose content may change while the method is running.
   *
   * <p>The serialized output consists of the number of entries, first key, first value, second key,
   * second value, and so on.