1. 为什么API需要穿好衣服再出门前几天排查一个线上问题时发现某个生产环境API直接向客户端返回了Python的原始堆栈信息包含服务器文件路径、数据库连接字符串等敏感内容。这种裸奔行为就像把自家钥匙挂在门口——不出问题才怪。在FastAPI开发中异常处理不是可选项而是API开发的基本素养。FastAPI作为现代Python异步框架虽然自带基础异常处理机制但很多开发者止步于HTTPException的基本用法。实际上完整的异常处理体系需要覆盖以下场景预期内的业务异常如权限不足、资源不存在预期外的系统异常如数据库连接失败请求参数校验失败WebSocket通信异常第三方API调用失败异步任务中的异常传递2. FastAPI异常处理核心机制2.1 异常处理的三层防御体系完善的API异常处理应该像洋葱一样分层外层全局异常拦截器Middleware捕获所有未处理的异常统一错误响应格式敏感信息过滤中层路由级异常处理业务逻辑异常转换状态码映射错误信息国际化内层参数校验层Pydantic模型校验路径参数校验查询参数校验# 典型的三层处理示例 from fastapi import FastAPI, HTTPException from pydantic import BaseModel app FastAPI() class Item(BaseModel): name: str price: float app.post(/items/) async def create_item(item: Item): if item.price 0: # 中层处理业务逻辑异常 raise HTTPException( status_code400, detailPrice cannot be negative, headers{X-Error: Invalid price} ) return item2.2 HTTPException的进阶用法大多数教程只教了HTTPException的基础用法其实它还有这些实用技巧headers参数传递额外的错误元信息raise HTTPException( status_code403, detailInsufficient permissions, headers{X-Required-Role: admin} )自定义错误类型继承HTTPException实现业务异常class InsufficientBalance(HTTPException): def __init__(self, balance: float): super().__init__( status_code402, detailfRequired balance not met (current: {balance}), headers{X-Min-Balance: 100.00} )错误链保留原始异常信息try: process_payment() except PaymentError as e: raise HTTPException( status_code400, detailPayment processing failed ) from e # 保留原始异常3. 全局异常处理实战3.1 自定义异常处理器注册全局处理器是避免裸奔的关键from fastapi import FastAPI, Request from fastapi.responses import JSONResponse from pydantic import ValidationError app FastAPI() app.exception_handler(ValueError) async def value_error_handler(request: Request, exc: ValueError): return JSONResponse( status_code400, content{message: fValue error: {str(exc)}}, ) app.exception_handler(ValidationError) async def validation_error_handler(request: Request, exc: ValidationError): return JSONResponse( status_code422, content{ message: Validation failed, details: exc.errors() }, )3.2 生产环境错误格式化对于生产环境错误响应应该包含错误唯一标识便于日志追踪错误分类业务错误/系统错误可读的错误信息可选的修复建议文档链接class ErrorResponse(BaseModel): error_id: str category: str message: str suggestion: Optional[str] doc_url: Optional[str] app.exception_handler(Exception) async def universal_handler(request: Request, exc: Exception): error_id str(uuid.uuid4()) logger.error(fError {error_id}: {str(exc)}, exc_infoTrue) return JSONResponse( status_code500, contentErrorResponse( error_iderror_id, categorysystem, messageAn unexpected error occurred, suggestionPlease try again later, doc_urlhttps://api.example.com/docs/errors ).dict() )4. WebSocket异常处理要点WebSocket连接需要特殊的异常处理策略连接阶段错误仍可使用HTTP状态码通信过程错误需要通过WebSocket协议发送错误帧连接保持部分错误不应断开连接from fastapi import WebSocket, WebSocketException app.websocket(/ws) async def websocket_endpoint(websocket: WebSocket): await websocket.accept() try: while True: data await websocket.receive_json() if data[type] not in [chat, heartbeat]: raise WebSocketException( code1008, # Policy Violation reasonInvalid message type ) # 处理消息... except WebSocketException as e: await websocket.close(codee.code, reasone.reason) except Exception as e: await websocket.close(code1011, reasonstr(e)[:123]) # 限制错误信息长度5. 常见陷阱与最佳实践5.1 千万不要这样处理异常直接暴露堆栈信息# 危险绝对不要这样做 app.exception_handler(Exception) async def bad_handler(request: Request, exc: Exception): return PlainTextResponse( str(exc), status_code500 )吞掉异常# 错误会被静默处理难以调试 try: risky_operation() except: pass过度泛化的捕获# 会捕获包括KeyboardInterrupt在内的所有异常 try: do_something() except Exception: handle_error()5.2 推荐的最佳实践错误分类处理class AppError(Exception): 基础业务异常 pass class PaymentError(AppError): 支付相关异常 pass class AuthError(AppError): 认证相关异常 pass错误代码体系ERROR_CODES { invalid_param: (400, Invalid parameter), auth_failed: (401, Authentication failed), insufficient_balance: (402, Insufficient balance), # ... }请求上下文记录app.middleware(http) async def log_errors(request: Request, call_next): try: return await call_next(request) except Exception as exc: logger.error(fError processing {request.url}: {exc}, extra{ path: request.url.path, method: request.method, params: dict(request.query_params) }) raise6. 测试你的异常处理完善的异常处理需要对应的测试策略from fastapi.testclient import TestClient client TestClient(app) def test_invalid_item(): response client.post(/items/, json{price: -1}) assert response.status_code 400 assert Price cannot be negative in response.json()[message] assert X-Error in response.headers def test_websocket_protocol_error(): with client.websocket_connect(/ws) as websocket: websocket.send_json({type: invalid}) response websocket.receive() assert response[type] websocket.close assert response[code] 1008异常处理的质量直接影响API的可靠性和安全性。花时间设计完善的错误处理机制就像给API穿上合适的衣服——既保护隐私又提升专业形象。