FastAPI 路径参数完全指南：从基础到高级校验实战 🚀
title: FastAPI 路径参数完全指南：从基础到高级校验实战 🚀
from fastapi import FastAPI
app = FastAPI()
@app.get("/users/{user_id}")
async def get_user(user_id: int):
return {"user_id": user_id}
@app.get("/items/{item_id}")
async def get_item(item_id: int):
return {"item_id": item_id}
from pydantic import conint
@app.get("/products/{product_id}")
async def get_product(product_id: conint(gt=1000)):
return {"product_id": product_id}
from fastapi import Path
@app.get("/credit-cards/{card_no}")
async def get_card(card_no: str = Path(..., regex=r"^[4-6]\d{15}$")):
return {"card_no": card_no}
from pydantic import BaseModel, validator
class ProductCode(str):
@classmethod
def validate(cls, value):
if not re.match(r"^[A-Z]{3}-\d{3}[A-Z]$", value):
raise ValueError("Invalid product code")
return cls(value)
@app.get("/products/{code}")
async def get_product(code: ProductCode):
return {"code": code}
from datetime import date
@app.get("/orders/{order_date}")
async def get_orders(order_date: date = Path(..., regex=r"^\d{4}-\d{2}-\d{2}$")):
if order_date > date.today():
raise HTTPException(400, "未来日期非法")
return query_orders(order_date)
# 危险示例
@app.get("/search/{keyword}")
async def unsafe_search(keyword: str):
query = f"SELECT * FROM products WHERE name LIKE '%{keyword}%'"
# 安全方案
@app.get("/search/{keyword}")
async def safe_search(keyword: str):
return await database.fetch_all(
"SELECT * FROM products WHERE name LIKE :keyword",
{"keyword": f"%{keyword}%"}
)
from pathlib import Path
@app.get("/files/{file_path:path}")
async def read_file(file_path: str = Path(..., regex=r"^[\w\-/]+$")):
full_path = BASE_DIR / file_path
if not full_path.resolve().startswith(BASE_DIR):
raise HTTPException(403, "非法路径访问")
return FileResponse(full_path)
@app.get("/orders/{order_id}")
async def get_order(order_id: str = Path(..., regex=r"^[A-Z]{2}\d{6}[A-Z0-9]{4}$")):
return query_order(order_id)
@app.get("/coordinates/{coord}")
async def parse_coordinate(coord: str = Path(..., regex=r"^([-+]?\d+\.\d+),\s*([-+]?\d+\.\d+)$")):
return parse_coord(coord)
| 错误代码 | 典型触发场景 | 解决方案 |
|---|---|---|
| 422 | 类型转换失败/正则不匹配 | 检查参数定义的校验规则 |
| 404 | 路径参数格式正确但资源不存在 | 验证业务逻辑中的数据存在性 |
| 500 | 未捕获的参数处理异常 | 添加 try/except 包裹敏感操作 |
| 400 | 自定义校验规则触发拒绝 | 检查验证器的逻辑条件 |
from enum import Enum
class Color(str, Enum):
RED = "red"
BLUE = "blue"
@app.get("/colors/{color}")
async def get_color(color: Color):
return {"color": color}
@app.get("/files/{file_path:path}")
async def read_file(file_path: str):
return {"file": file_path}
curl -X GET "http://localhost:8000/credit-cards/4111111111111111"
评论
发表评论