# Content-Type の厳格チェック { #strict-content-type-checking }

既定では、FastAPI は JSON リクエストボディに対して厳格な `Content-Type` ヘッダーのチェックを行います。つまり、JSON のリクエストを JSON として解析するには、有効な `Content-Type` ヘッダー（例: `application/json`）を必ず含める必要があります。

## CSRF のリスク { #csrf-risk }

この既定の挙動は、ある特定の状況における Cross-Site Request Forgery（CSRF）攻撃の一種に対する保護を提供します。

これらの攻撃は、次の条件を満たすときにブラウザが CORS のプリフライトチェックを行わずにスクリプトからリクエストを送信できる事実を悪用します。

- `Content-Type` ヘッダーがない（例: `Blob` をボディにして `fetch()` を使う）

## API Request Parameters

### LDAPUsername

Is AD/LDAP username to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.

| Params               | Value                                          |

   * registry suffixes, since domain name registries collectively control all internet domain names.
   *
   * <p>For considerations on whether the public suffix or registry suffix designation is more
   * suitable for your application, see <a
   * href="https://github.com/google/guava/wiki/InternetDomainNameExplained">this article</a>.
   *
   * @return {@code true} if this domain name appears exactly on the public suffix list
   * @since 6.0
   */

      .also { eventRecorder.clearAllEvents() }

  private fun dnsResponse(s: String): MockResponse =
    MockResponse
      .Builder()
      .body(Buffer().write(s.decodeHex()))
      .addHeader("content-type", "application/dns-message")
      .addHeader("content-length", s.length / 2)
      .build()

  private fun buildLocalhost(
    bootstrapClient: OkHttpClient,
    includeIPv6: Boolean,
    post: Boolean = false,

 * loader and prevent it from being garbage collected. This poses a problem for environments where
 * you want to throw away the class loader. For example, dynamically reloading a web application or
 * unloading an OSGi bundle.
 *
 * <p>{@code com.google.common.base.FinalizableReferenceQueue} loads this class in its own class
 * loader. That way, this class doesn't prevent the main class loader from getting garbage

production clusters, deploy a [Distributed](https://docs.min.io/community/minio-object-store/operations/deployments/baremetal-deploy-minio-as-a-container.html) MinIO deployment.

MinIO needs a persistent volume to store configuration and application data. For testing purposes, you can launch MinIO by simply passing a directory (`/data` in the example below). This directory gets created in the container filesystem at the time of container start. But all the data is lost after container exits....

    @Resource
    protected ElevateWordBhv elevateWordBhv;

    /** Behavior handler for LabelType entity operations */
    @Resource
    protected LabelTypeBhv labelTypeBhv;

    /** Configuration settings for Fess application */
    @Resource
    protected FessConfig fessConfig;

    /** Client for interacting with the search engine */
    @Resource
    protected SearchEngineClient searchEngineClient;

    /**

		return
	}

	// Ensure body content type is opaque to ensure that request body has not
	// been interpreted as form data.
	contentType := r.Header.Get("Content-Type")
	if contentType != "application/octet-stream" {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrBadRequest), r.URL)
		return
	}

	password := cred.SecretKey

       * embeds the PEM files in Java strings; most applications will instead read this from a resource
       * file that gets bundled with the application.
       */
      private fun trustedCertificatesInputStream(): InputStream {
        ... // Full source omitted. See sample.
      }

    non-ASCII characters (including international characters and emoji).

 *  **Call canceling is more reliable.**  We had a bug where a socket being
     connected wasn't being closed when the application used `Call.cancel()`.

 *  **Changing a HttpUrl’s scheme now tracks the default port.** We had a bug
    where changing a URL from `http` to `https` would leave it on port 80.

 *  **Okio has been updated to 1.6.0.**