mirror/fastapi
1
0
Fork 0
mirror of https://github.com/fastapi/fastapi.git synced 2026-03-09 10:27:54 -04:00
Code Issues Packages Projects Releases Wiki Activity

🍱 Update Drawio diagrams SVGs, single file per diagram, sans-serif font (#13706)

Browse Source 
---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
This commit is contained in:
Sebastián Ramírez
2025-05-11 15:37:26 +02:00
committed by GitHub
parent f3bfa3b8a5
commit 214e0740c8
56 changed files with 5707 additions and 2368 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/en/docs/deployment/https.md
View File

@@ -85,7 +85,7 @@ First, the browser would check with the **DNS servers** what is the **IP for the
The DNS servers would tell the browser to use some specific **IP address**. That would be the public IP address used by your server, that you configured in the DNS servers.
<img src="/img/deployment/https/https01.svg">
<img src="/img/deployment/https/https01.drawio.svg">
### TLS Handshake Start
@@ -93,7 +93,7 @@ The browser would then communicate with that IP address on **port 443** (the HTT
The first part of the communication is just to establish the connection between the client and the server and to decide the cryptographic keys they will use, etc.
<img src="/img/deployment/https/https02.svg">
<img src="/img/deployment/https/https02.drawio.svg">
This interaction between the client and the server to establish the TLS connection is called the **TLS handshake**.
@@ -111,7 +111,7 @@ Using the **SNI extension** discussed above, the TLS Termination Proxy would che
In this case, it would use the certificate for `someapp.example.com`.
<img src="/img/deployment/https/https03.svg">
<img src="/img/deployment/https/https03.drawio.svg">
The client already **trusts** the entity that generated that TLS certificate (in this case Let's Encrypt, but we'll see about that later), so it can **verify** that the certificate is valid.
@@ -133,19 +133,19 @@ Now that the client and server (specifically the browser and the TLS Termination
So, the client sends an **HTTPS request**. This is just an HTTP request through an encrypted TLS connection.
<img src="/img/deployment/https/https04.svg">
<img src="/img/deployment/https/https04.drawio.svg">
### Decrypt the Request
The TLS Termination Proxy would use the encryption agreed to **decrypt the request**, and would transmit the **plain (decrypted) HTTP request** to the process running the application (for example a process with Uvicorn running the FastAPI application).
<img src="/img/deployment/https/https05.svg">
<img src="/img/deployment/https/https05.drawio.svg">
### HTTP Response
The application would process the request and send a **plain (unencrypted) HTTP response** to the TLS Termination Proxy.
<img src="/img/deployment/https/https06.svg">
<img src="/img/deployment/https/https06.drawio.svg">
### HTTPS Response
@@ -153,7 +153,7 @@ The TLS Termination Proxy would then **encrypt the response** using the cryptogr
Next, the browser would verify that the response is valid and encrypted with the right cryptographic key, etc. It would then **decrypt the response** and process it.
<img src="/img/deployment/https/https07.svg">
<img src="/img/deployment/https/https07.drawio.svg">
The client (browser) will know that the response comes from the correct server because it is using the cryptography they agreed using the **HTTPS certificate** before.
@@ -163,7 +163,7 @@ In the same server (or servers), there could be **multiple applications**, for e
Only one process can be handling the specific IP and port (the TLS Termination Proxy in our example) but the other applications/processes can be running on the server(s) too, as long as they don't try to use the same **combination of public IP and port**.
<img src="/img/deployment/https/https08.svg">
<img src="/img/deployment/https/https08.drawio.svg">
That way, the TLS Termination Proxy could handle HTTPS and certificates for **multiple domains**, for multiple applications, and then transmit the requests to the right application in each case.
@@ -173,7 +173,7 @@ At some point in the future, each certificate would **expire** (about 3 months a
And then, there would be another program (in some cases it's another program, in some cases it could be the same TLS Termination Proxy) that would talk to Let's Encrypt, and renew the certificate(s).
<img src="/img/deployment/https/https.svg">
<img src="/img/deployment/https/https.drawio.svg">
The **TLS certificates** are **associated with a domain name**, not with an IP address.