Skip to content

Configuration

All configuration lives in TinyauthConfig, a frozen dataclass you pass to the middleware.

from fastapi_simple_tinyauth.config import TinyauthConfig

config = TinyauthConfig(
    trusted_proxies=["10.0.0.0/8"],
    header_user="Remote-User",
    header_email="Remote-Email",
    header_name="Remote-Name",
    header_groups="Remote-Groups",
    header_sub="Remote-Sub",
)

Fields

  • trusted_proxies (required): a non-empty list of net/mask (CIDR) strings or bare IP addresses. A bare address such as "10.0.0.5" is treated as a single host. Both IPv4 and IPv6 are supported.
  • header_user: header carrying the username. Default "Remote-User".
  • header_email: header carrying the email. Default "Remote-Email".
  • header_name: header carrying the display name. Default "Remote-Name".
  • header_groups: header carrying the comma-separated groups. Default "Remote-Groups".
  • header_sub: header carrying the subject identifier. Default "Remote-Sub".

Header names are case-insensitive (they are matched via Starlette's header lookup).

Validation

The trusted-proxy list is validated at construction time:

  • An empty list raises ValueError.
  • A list with only blank entries raises ValueError.
  • An unparseable entry (for example "not-a-network") raises ValueError.
from fastapi_simple_tinyauth.config import TinyauthConfig

TinyauthConfig(trusted_proxies=[])            # ValueError
TinyauthConfig(trusted_proxies=["bad/mask"])  # ValueError

Custom header names

If your proxy uses different header names (for example a bespoke SSO setup), override them:

config = TinyauthConfig(
    trusted_proxies=["127.0.0.1/32"],
    header_user="X-Auth-User",
    header_groups="X-Auth-Groups",
)

See Trusted proxies for how trusted_proxies is enforced and the caveat about peer addresses behind a proxy.