Allow custom http header name instead of default "Authorization"

[hanssens]

First Check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

# see wanted code

Description

The http header for the different authentication protocols is currently hardcoded to "Authorization", which on itself is accurate according to the standards ((ex. MDN definition)[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization]). There are, however, reasons in practice you would want to have a different, custom named header.

For example, in my case where the FastAPI is hosted behind a proxy which already requires the Authorization header to be set. I would like it to be set in the FastAPI to something else (e.g. like "x-bearer-key" or "foo").

Is it possible to define a custom http header name for authorization, instead of the default "Authorization" header name?

Wanted Solution

example code of what would be great

auth_scheme = HTTPBearer(authorization_header='MY-OWN-KEY-INSTEAD-OF-AUTHORIZATION')

Wanted Code

# example code of what would be great
auth_scheme = HTTPBearer(authorization_header='MY-OWN-KEY-INSTEAD-OF-AUTHORIZATION')

Alternatives

No response

Operating System

Linux, Windows, macOS

Operating System Details

No response

FastAPI Version

0.74

Python Version

3.10.x

Additional Context

No response

[hanssens]

I've setup PR #4652 to facilitate this (relatively small) change.

There are no breaking changes, as the default http header name is by convention still Authorization. It simply allows this header name to be overridden, when needed.

Hope this is a helpful addition. ;)

[Kludex]

The problem here is that HTTPBearer is compliant with OpenAPI specs.

An alternative solution would be to inherit SecurityBase, and implement your own class.

I think this point was discussed at some point in the last year, I don't know where tho.

[RSMuthu]

I like this enhancement. But just like @Kludex mentioned, we can inherit this from SecurityBase and add even more customization as we need.

class CustomSecurityBase(SecurityBase):
    def __init__(
        self, auto_error: bool = True
        scheme_name: Optional[str] = None,
    ):
        self.scheme_name = scheme_name or self.__class__.__name__
        self.auto_error = auto_error

    async def __call__(
        self, request: Request
    ) -> Optional[CustomAuthorizationCredentials]: # use HTTPAuthorizationCredentials for builtin use
        authorization: str = request.headers.get("<custom_auth_header>")

        # get authorisation schema parameters
        # & then Validate it here.

        if not_valid:
            if self.auto_error:
                raise HTTPException(
                    status_code=HTTP_403_FORBIDDEN, detail="Not authenticated"
                )
            else:
                return None
        return CustomAuthorizationCredentials(**data)

You can develop using the above template to suit the need
And then add this as dependency to the endpoint

[hanssens]

Thanks for the feedback, guys. Keeping the standard by default makes total sense and only for that argument I would respect it if PR #4652 therefor would be rejected and closed.

Having a derived class certainly works as well. And especially if more customizations are needed, I agree this would be the way to go.

I leave it to you guys to decide what to do with this issue and PR.

[toxicbloud]

Hello I made my own class like @Kludex said, and it works, but I can't find how to make FastApi change the header in swagger UI.
I have to duplicate the header getter for the documentation page to work properly.

[Kludex]

It's not possible due to OpenAPI limitations, not FastAPI ones.

[ShaharIlany]

Hey!

You can use this instead:

from fastapi import Security
from fastapi.security import APIKeyHeader

@app.get("/auth-needed")
def auth_needed(api_key = Security(APIKeyHeader(name="X-API-Key"))):
    pass