BaseHTTPMiddleware causes form data loss when parsing with custom limits
criticalconfigurationUpdated Nov 20, 2024(via Exa)
Sources
How to detect:
Using BaseHTTPMiddleware to intercept requests and call request.form() with custom max_part_size results in complete loss of form data. The form data is not passed through to downstream handlers after being parsed in the middleware.
Recommended action:
Do not use BaseHTTPMiddleware for form parsing interception. Instead, use alternative approaches: create a custom request class following FastAPI's custom request documentation, use only the Request dependency with custom form constraints (though this won't work in all cases), or create a custom middleware inspired by base HTTP middleware that properly forwards the stream or caches it. Reference discussion #13739 for more details on BaseHTTPMiddleware limitations.