client = TestClient(app)


def test_security_oauth2():
    response = client.get("/users/me", headers={"Authorization": "Bearer footokenbar"})
    assert response.status_code == 200, response.text
    assert response.json() == {"username": "Bearer footokenbar"}


def test_security_oauth2_password_other_header():
    response = client.get("/users/me", headers={"Authorization": "Other footokenbar"})
    assert response.status_code == 200, response.text

client = TestClient(app)


def test_security_oauth2():
    response = client.get("/users/me", headers={"Authorization": "Bearer footokenbar"})
    assert response.status_code == 200, response.text
    assert response.json() == {"username": "Bearer footokenbar"}


def test_security_oauth2_password_other_header():
    response = client.get("/users/me", headers={"Authorization": "Other footokenbar"})
    assert response.status_code == 200, response.text

{!../../docs_src/middleware/tutorial001.py!}
```

/// tip | "Tipp"

Beachten Sie, dass benutzerdefinierte proprietäre Header hinzugefügt werden können. <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers" class="external-link" target="_blank">Verwenden Sie dafür das Präfix 'X-'</a>.

```

////

O **FastAPI** irá **extrair** os dados de **cada campo** a partir dos **cabeçalhos** da requisição e te retornará o modelo do Pydantic que você definiu.

### Checando a documentação

Você pode ver os headers necessários na interface gráfica da documentação em `/docs`:

<div class="screenshot">
<img src="/img/tutorial/header-param-models/image01.png">
</div>

### Proibindo Cabeçalhos adicionais

HSPLokhttp3/Headers$Builder;-><init>()V
HSPLokhttp3/Headers$Builder;->build()Lokhttp3/Headers;
HSPLokhttp3/Headers$Builder;->removeAll(Ljava/lang/String;)Lokhttp3/Headers$Builder;
HSPLokhttp3/Headers;-><init>([Ljava/lang/String;)V
HSPLokhttp3/Headers;->get(Ljava/lang/String;)Ljava/lang/String;
HSPLokhttp3/Headers;->name(I)Ljava/lang/String;
HSPLokhttp3/Headers;->newBuilder()Lokhttp3/Headers$Builder;

    assert response.status_code == 200, response.text
    assert response.headers["content-type"] == "text/html; charset=utf-8"
    assert "window.opener.swaggerUIRedirectOauth2" in response.text


def test_redoc():
    response = client.get("/redoc")
    assert response.status_code == 200, response.text
    assert response.headers["content-type"] == "text/html; charset=utf-8"
    assert "redoc@next" in response.text

                        result.getSearchFieldLogList().add(new Pair<>(e.getKey(), e.getValue().toString()));
                    }
                });
            }
            final Object headersObj = source.get("headers");
            if (headersObj instanceof Map) {
                ((Map<String, ?>) headersObj).entrySet().stream().forEach(e -> {
                    if (e.getValue() instanceof String[]) {

@app.get("/users/me")
def read_current_user(current_user: User = Depends(get_current_user)):
    return current_user


client = TestClient(app)


def test_security_api_key():
    response = client.get("/users/me", headers={"key": "secret"})
    assert response.status_code == 200, response.text
    assert response.json() == {"username": "secret"}


def test_security_api_key_no_key():
    response = client.get("/users/me")

Cache Miss will be typical if the item has not been read from the network, is uncacheable, or is past it's 
lifetime based on Response cache headers.

 - CallStart 
 - **CacheMiss**
 - ProxySelectStart
 - ... Standard Events ...
 - CallEnd
        
### Conditional Cache Hit
 

@app.get("/users/me")
def read_current_user(current_user: User = Depends(get_current_user)):
    return current_user


client = TestClient(app)


def test_security_api_key():
    response = client.get("/users/me", headers={"key": "secret"})
    assert response.status_code == 200, response.text
    assert response.json() == {"username": "secret"}


def test_security_api_key_no_key():
    response = client.get("/users/me")