To achieve this, the `:80`-backend must have a list of "allowed origins".

In this case, the list would have to include `http://localhost:8080` for the `:8080`-frontend to work correctly.

## Wildcards

It's also possible to declare the list as `"*"` (a "wildcard") to say that all are allowed.

The above scenario is representative of most TLS set ups: the client uses certificates to validate
the identity of a server. The converse is also possible. Here we create a server that authenticates
a client and a client that authenticates a server.

```java
// Create the root for client and server to trust. We could also use different roots for each!
HeldCertificate rootCertificate = new HeldCertificate.Builder()
    .certificateAuthority(0)

## Mix `Path`, `Query` and body parameters

First, of course, you can mix `Path`, `Query` and request body parameter declarations freely and **FastAPI** will know what to do.

And you can also declare body parameters as optional, by setting the default to `None`:

//// tab | Python 3.10+

```Python hl_lines="18-20"
{!> ../../docs_src/body_multiple_params/tutorial001_an_py310.py!}
```

////

Most of the standard headers are separated by a "hyphen" character, also known as the "minus symbol" (`-`).

But a variable like `user-agent` is invalid in Python.

So, by default, `Header` will convert the parameter names characters from underscore (`_`) to hyphen (`-`) to extract and document the headers.

Also, HTTP headers are case-insensitive, so, you can declare them with standard Python style (also known as "snake_case").

by setting `x-amz-storage-class=STANDARD/REDUCED_REDUNDANCY` for each object uploads so effectively utilizing the capacity of the cluster. Additionally these can also be enforced using IAM policies to make sure the client uploads with correct HTTP headers.

- MinIO also supports expansion of existing clusters in server pools. Each pool is a self contained entity with same SLA's (read/write quorum) for each object as original cluster. By using the existing namespace for lookup validation...

          return 10
        }

        override fun source(): BufferedSource {
          return Buffer().writeUtf8("hello")
        }
      }
    assertFailsWith<IOException> {
      body.bytes()
    }.also { expected ->
      assertThat(expected.message).isEqualTo(
        "Content-Length (10) and stream length (5) disagree",
      )
    }
  }

  @Test
  fun bytesThrowsMoreThanIntMaxValue() {

///

/// note | "Technical Details"

You could also use `from starlette.requests import Request`.

**FastAPI** provides it as a convenience for you, the developer. But it comes directly from Starlette.

///

### Before and after the `response`

You can add code to be run with the `request`,  before any *path operation* receives it.

And also after the `response` is generated, before returning it.

      builder.build()
    }.also { expected ->
      assertThat(expected.message).isEqualTo("Null interceptor: [null]")
    }
  }

  @Test fun nullNetworkInterceptorInList() {
    val builder = OkHttpClient.Builder()
    builder.networkInterceptors().addAll(listOf(null) as List<Interceptor>)
    assertFailsWith<IllegalStateException> {
      builder.build()
    }.also { expected ->

But for now, let's check these important **conceptual ideas**. These concepts also apply to any other type of web API. 💡

## Security - HTTPS

In the [previous chapter about HTTPS](https.md){.internal-link target=_blank} we learned about how HTTPS provides encryption for your API.

We also saw that HTTPS is normally provided by a component **external** to your application server, a **TLS Termination Proxy**.

// He works in a Company (belongs to), he has a Manager (belongs to - single-table), and also managed a Team (has many - single-table)
// He speaks many languages (many to many) and has many friends (many to many - single-table)
// His pet also has one Toy (has one - polymorphic)
// NamedPet is a reference to a named `Pet` (has one)
type User struct {
	gorm.Model
	Name      string