* `username`: `Rick`
* `password`: `Portal Gun`
* `extra`: `Mr. Poopybutthole`

erhält er eine Error-Response, die ihm mitteilt, dass das Feld `extra` nicht erlaubt ist:

```json
{
    "detail": [
        {
            "type": "extra_forbidden",
            "loc": ["body", "extra"],
            "msg": "Extra inputs are not permitted",
            "input": "Mr. Poopybutthole"
        }
    ]

```json
{
    "detail": [
        {
            "type": "extra_forbidden",
            "loc": ["body", "extra"],
            "msg": "Extra inputs are not permitted",
            "input": "Mr. Poopybutthole"
        }
    ]
}
```

## Résumer { #summary }

你可以在 `/docs` 页面的 UI 中查看查询参数：

<div class="screenshot">
<img src="/img/tutorial/query-param-models/image01.png">
</div>

## 禁止额外的查询参数 { #forbid-extra-query-parameters }

在一些特殊的使用场景中（可能不是很常见），你可能希望**限制**你要接收的查询参数。

你可以使用 Pydantic 的模型配置来 `forbid` 任何 `extra` 字段：

{* ../../docs_src/query_param_models/tutorial002_an_py310.py hl[10] *}

假设有一个客户端尝试在**查询参数**中发送一些**额外的**数据，它将会收到一个**错误**响应。

  SHELL
end

def suse_common(config, name, extra: '')
  linux_common(
    config,
    name,
    update_command: 'zypper --non-interactive list-updates',
    update_tracking_file: '/var/cache/zypp/packages/last_update',
    install_command: 'zypper --non-interactive --quiet install --no-recommends',
    extra: extra
  )
end

def sles_common(config, name)
  extra = <<-SHELL

///

## Agregar información extra { #add-extra-information }

Puedes declarar información extra en `Field`, `Query`, `Body`, etc. Y será incluida en el JSON Schema generado.

Aprenderás más sobre cómo agregar información extra más adelante en la documentación, cuando aprendamos a declarar ejemplos.

/// warning | Advertencia

</div>

## Forbid Extra Headers { #forbid-extra-headers }

In some special use cases (probably not very common), you might want to **restrict** the headers that you want to receive.

You can use Pydantic's model configuration to `forbid` any `extra` fields:

{* ../../docs_src/header_param_models/tutorial002_an_py310.py hl[10] *}

If a client tries to send some **extra headers**, they will receive an **error** response.

<img src="/img/tutorial/query-param-models/image01.png">
</div>

## Ek Query Parameter'ları Yasaklayın { #forbid-extra-query-parameters }

Bazı özel kullanım senaryolarında (muhtemelen çok yaygın değil), almak istediğiniz query parameter’ları **kısıtlamak** isteyebilirsiniz.

Pydantic’in model konfigürasyonunu kullanarak `extra` field’ları `forbid` edebilirsiniz:

{* ../../docs_src/query_param_models/tutorial002_an_py310.py hl[10] *}

     * @return the resource group SIDs array
     */
    public SID[] getResourceGroupSids() {
        return this.resourceGroupSids;
    }

    /**
     * Returns an array of extra SIDs associated with the user.
     * @return the extra SIDs array
     */
    public SID[] getExtraSids() {
        return this.extraSids;
    }

    /**
     * Returns the user account control flags.

/// info | Informação

`Query`, `Path` e outras classes que você verá depois são subclasses de uma classe comum `Param`.

Todas elas compartilham os mesmos parâmetros para validação adicional e metadados que você viu.

///

/// note | Detalhes Técnicos

Quando você importa `Query`, `Path` e outras de `fastapi`, elas são na verdade funções.

* [X-Forwarded-Host](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Host)

///

Aun así, como el **servidor de aplicaciones** no sabe que está detrás de un **proxy** de confianza, por defecto, no confiaría en esos headers.