context = browser.new_context(viewport={"width": 960, "height": 1080})
    browser = playwright.chromium.launch(headless=False)
    context = browser.new_context()
    page = context.new_page()
    page.goto("http://localhost:8000/docs")
    page.get_by_role("link", name="/items/").click()
    # Manually add the screenshot
    page.screenshot(path="docs/en/docs/img/tutorial/cookie-param-models/image01.png")

    # ---------------------

## Пример атаки { #example-attack }

Представьте, что вы сделали способ запускать локального ИИ-агента.

Он предоставляет API по адресу

```
http://localhost:8000/v1/agents/multivac
```

Есть также фронтенд по адресу

```
http://localhost:8000
```

/// tip | Совет

Обратите внимание, что у обоих один и тот же хост.

///

    browser = playwright.chromium.launch(headless=False)
    # Update the viewport manually
    context = browser.new_context(viewport={"width": 960, "height": 1080})
    page = context.new_page()
    page.goto("http://localhost:8000/docs")
    page.get_by_role("button", name="POST /data Post Data").click()
    # Manually add the screenshot
    page.screenshot(path="docs/en/docs/img/tutorial/json-base64-bytes/image01.png")

    # ---------------------

from inline_snapshot import snapshot

app = FastAPI(
    servers=[
        {"url": "/", "description": "Default, relative server"},
        {
            "url": "http://staging.localhost.tiangolo.com:8000",
            "description": "Staging but actually localhost still",
        },
        {"url": "https://prod.example.com"},
    ]
)


@app.get("/foo")
def foo():
    return {"message": "Hello World"}

## Ejemplo de ataque { #example-attack }

Imagina que construyes una forma de ejecutar un agente de IA local.

Provee un API en

```
http://localhost:8000/v1/agents/multivac
```

También hay un frontend en

```
http://localhost:8000
```

/// tip | Consejo

Ten en cuenta que ambos tienen el mismo host.

///

  integrity sha512-8MJk1bcQUAYkuvCyWZxaldiwoDG0E0AMzBGA6cv3WfuvJySiPgfidEPBFCRRH3cZm6SVZwo/oRlK1ehi1QNEIQ==

emoji-regex@^8.0.0:
  version "8.0.0"
  resolved "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-8.0.0.tgz#e818fd69ce5ccfcb404594f842963bf53164cc37"
  integrity sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==

encodeurl@~1.0.2:

    public ExpectedException expectedEx = ExpectedException.none();

    static {
        // unreleased major and two unreleased minors ( minor in feature freeze )
        sampleVersions.put("8.0.0", asList("7_0_0", "7_0_1", "7_1_0", "7_1_1", "7_2_0", "7_3_0", "8.0.0"));
        sampleVersions.put(
            "7.0.0-alpha1",
            asList(
                "6_0_0_alpha1",
                "6_0_0_alpha2",
                "6_0_0_beta1",

---

##### GLOBAL METADATA

- meta:
    cluster: elasticsearch-ci

##### JOB DEFAULTS

- job:
    vault:
      url: https://secrets.elastic.co:8200
      role_id: 1ba1ac3e-aee4-d040-d9a3-6ae23bd2b3db
    node: "general-purpose"
    concurrent: true
    logrotate:
      daysToKeep: 30
      numToKeep: 500
      artifactDaysToKeep: 7
    parameters:
      - string:
          name: branch_specifier

这种攻击主要在以下情况下相关：

- 应用在本地（如 `localhost`）或内网中运行
- 且应用没有任何认证，假定来自同一网络的请求都可信。

## 攻击示例 { #example-attack }

假设你构建了一个本地运行的 AI 代理。

它提供了一个 API，地址为

```
http://localhost:8000/v1/agents/multivac
```

另有一个前端，地址为

```
http://localhost:8000
```

/// tip | 提示

注意它们的主机相同。

///

之后，你可以通过前端让该 AI 代理替你执行操作。

由于它在本地运行、而非暴露在开放的互联网，你决定不配置任何认证，只信任对本地网络的访问。

于是，你的某位用户安装并在本地运行了它。

</div>

Python tarafından otomatik oluşturulan, dosyanızın içindeki `__name__` adlı dahili değişkenin değeri `"__main__"` string'i olur.

Dolayısıyla şu bölüm:

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

çalışır.

---

Ancak modülü (dosyayı) import ederseniz bu gerçekleşmez.

Yani örneğin `importer.py` adında başka bir dosyanız var ve içinde şunlar bulunuyorsa:

```Python
from myapp import app