FastAPI Interview Questions

• ASGI defines a single callable async def app(scope, receive, send) handling HTTP/WebSocket/lifespan messages.
• Lifespan events (@app.on_event("startup") legacy / lifespan context manager modern) initialize pools (DB, Redis, httpx clients) once per process — dependencies then reuse them.
• Uvicorn manages the event loop; multiple worker processes each run the full lifespan. Interview depth: explain why per-request engine creation is an anti-pattern vs lifespan-held pools.

• Within ONE request, identical dependency (by callable identity + params) resolves once — Depends(get_db) in handler + sub-dependency shares the session.
• Bust via use_cache=False on Depends when you genuinely need fresh resolution (per-item security checks in loops).
• Global scope alternative: module-level singletons for cross-request sharing (connection pools) — DI is for per-request composition.

async def get_db():
    async with async_session() as s:
        yield s

• Code before yield runs pre-handler; after-yield executes AFTER response completes (exit of context), enabling commit/rollback decisions based on exceptions propagated from handlers.
• Caveat: background tasks using that dependency may outlive — FastAPI handles ordering but long tasks should open own sessions. Exception injection: raising inside post-yield wraps handler errors — understand interplay with custom exception middleware.

class RoleChecker:
    def __init__(self, *roles): self.roles = set(roles)
    def __call__(self, user: User = Depends(get_current_user)):
        if user.role not in self.roles: raise HTTPException(403)

@router.post("/admin", dependencies=[Depends(RoleChecker("admin"))])

• Callable instances become parameterized dependencies — reusable guards.
• OAuth2 scopes: Security(get_current_user, scopes=["items:write"]); token contains scopes; SecurityScopes dependency verifies hierarchy — maps to OpenAPI security UI.

@field_validator("email")
@classmethod
def normalize(cls, v): return v.lower()

@model_validator(mode="after")
def check_dates(self):
    if self.end < self.start: raise ValueError(...)

• field_validator runs per-field pre/post coercion (mode="before" sees raw input).
• model_validator "before" receives raw dict (cross-field normalization), "after" receives constructed model instance. Return values replace data — forgetting to return in before-validators silently drops fields (classic bug).

• Routes compile a dependency map at first request; solving walks sub-dependencies depth-first, honoring use_cache per node, injecting request-scoped values.
• Edge bites: same callable imported via two module paths = two identities → double resolution; class dependencies instantiate per resolution unless cached; generator dependencies nest — cleanup order is reverse-resolution.
• Security dependencies resolving BEFORE body validation: auth failures return 401 without parsing body (cheap reject path worth knowing).

• Requirement: never block. Proving: loop-lag monitor (asyncio debug clock drift), otel span gaps, py-spy showing handlers inside blocking frames.
• Common offenders: requests/boto3/SQLAlchemy sync in async def, CPU-heavy JSON transforms, DNS via getaddrinfo.
• Remedies: async-native libs, run_in_threadpool explicit for unavoidable blocks, process pools for CPU. CI guard: lint rules flagging known-blocking imports inside async functions.

• Each task copies context; contextvars set in middleware ARE visible in handler because middleware awaits downstream within same context chain — but background tasks spawn AFTER response may or may not inherit depending on creation site.
• Starlette BaseHTTPMiddleware historically broke contextvar propagation into BackgroundTasks (new task context) — workarounds pass explicitly or use pure ASGI middleware.
• OTel relies on contextvars — broken propagation silently disconnects traces.

• BaseHTTPMiddleware wraps downstream as sub-task: enables easy request/response mutation but adds task overhead per request, historically breaks contextvars/background semantics and streaming backpressure.
• Pure ASGI (scope, receive, send) sees message-level events: zero overhead, full control (modify send's http.response.start headers), but more boilerplate. Guidance: pure ASGI for hot-path cross-cutting (tracing, security headers); BaseHTTP acceptable for low-QPS conveniences.

• OpenTelemetry auto-instrumentation (fastapi/sqlalchemy/httpx) creates server span → child client spans; manual spans via tracer.start_as_current_span for service boundaries.
• Async correctness: context attached per task automatically by instrumentation; beware fire-and-forget tasks losing parent — inject context explicitly (attach(detached_context)).
• Sampling strategy: head probabilistic + tail keep-errors/slow at collector; propagate traceparent outbound so partner services join traces.