We added a logging middleware to a FastAPI service and a server-sent events endpoint stopped streaming smoothly: events arrived in bursts, timings were wrong and disconnects went unnoticed. The middleware used BaseHTTPMiddleware. Why it interferes, and how pure ASGI middleware fixes it.
Sign in with Google worked locally and on staging but failed in production with redirect_uri_mismatch. Behind the TLS proxy our FastAPI app built an http:// callback because Uvicorn did not trust the proxy's headers. How we traced and fixed it.
Every value in our orders API was a bound parameter, except the sort column, which was pasted into ORDER BY from the query string. A pentest proved it was injectable. We replaced it with an allowlist map and added tests that fuzz the sort input.
One slow partner API call made our whole FastAPI service stop answering, health checks included, until Kubernetes restarted the pods. A synchronous requests call and a time.sleep inside async def were blocking the event loop.
Our chat assistant streamed tokens smoothly on localhost but in production the whole answer appeared after 14 seconds. nginx was buffering the event stream and gzip was holding bytes. How we proved it with curl and fixed it without breaking other routes.
Our RAG prototype was one folder where the PDF loader, the vector client and the API route imported each other freely. Here is the layout we moved to: four packages with enforced boundaries, a shared contract module, versioned indexes and an eval gate in CI.
Every few hours our FastAPI service started failing with QueuePool limit of size 5 overflow 10 reached, then recovered on its own. Two code paths opened SQLAlchemy sessions nobody closed, and only the garbage collector gave the connections back. Full repro, fix and pool monitoring inside.