| `Forwarded`   | For outgoing requests, the original source IP. Note that since we spoof IPs in most cases, this usually is the same as the actual IP seen. For incoming requests, this is used only for traffic from waypoints (which are trusted and cannot spoof IPs) |

she had never done such a thing before, but she remembered having
seen in her brother's Latin Grammar, `A mouse--of a mouse--to a
mouse--a mouse--O mouse!'  The Mouse looked at her rather
inquisitively, and seemed to her to wink with one of its little
eyes, but it said nothing.

  `Perhaps it doesn't understand English,' thought Alice; `I
daresay it's a French mouse, come over with William the

  }

  /**
   * The version of this test supplied by {@link MapInterfaceTest} fails for this particular Map
   * implementation, because {@code map.get()} returns a view collection that changes in the course
   * of a call to {@code remove()}. Thus, the expectation doesn't hold that {@code map.remove(x)}
   * returns the same value which {@code map.get(x)} did immediately beforehand.
   */
  @Override
  public void testRemove() {

   * parameter as non-nullable (since passing null to a FilenameFilter is unsafe in general), but if
   * someone still manages to pass null, let's continue to have the method work.
   *
   * (PatternFilenameFilter is of course one of those classes that shouldn't be a publicly visible
   * class to begin with but rather something returned from a static factory method whose declared

# Body - Multiple Parameters

Now that we have seen how to use `Path` and `Query`, let's see more advanced uses of request body declarations.

## Mix `Path`, `Query` and body parameters

First, of course, you can mix `Path`, `Query` and request body parameter declarations freely and **FastAPI** will know what to do.

And you can also declare body parameters as optional, by setting the default to `None`:

=== "Python 3.10+"

## Running on Startup

In most cases, when you create a web API, you want it to be **always running**, uninterrupted, so that your clients can always access it. This is of course, unless you have a specific reason why you want it to run only in certain situations, but most of the time you want it constantly running and **available**.

### In a Remote Server

    A `Response` returned directly by your *path operation function* won't be documented in OpenAPI (for example, the `Content-Type` won't be documented) and won't be visible in the automatic interactive docs.

!!! info
    Of course, the actual `Content-Type` header, status code, etc, will come from the `Response` object you returned.

### Document in OpenAPI and override `Response`

 *
 * <p>The multimap does not store duplicate key-value pairs. Adding a new key-value pair equal to an
 * existing key-value pair has no effect.
 *
 * <p>Null keys and values are permitted (provided, of course, that the respective comparators
 * support them). All optional multimap methods are supported, and all returned views are
 * modifiable.
 *

  public static void assertEqualIgnoringOrder(Iterable<?> expected, Iterable<?> actual) {
    List<?> exp = copyToList(expected);
    List<?> act = copyToList(actual);
    String actString = act.toString();

    // Of course we could take pains to give the complete description of the
    // problem on any failure.

    // Yeah it's n^2.
    for (Object object : exp) {
      if (!act.remove(object)) {
        Assert.fail(

#### A "professional" attack

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And would get just one extra correct letter at a time.