Combined strip_prefix and add_prefix produce the wrong upstream path

Nobody has started this yet — be first.

Business impact

Any route that uses both strip_prefix and add_prefix together (a common combination -- "drop our external /api/v1 prefix and route into the upstream's own /v2 namespace instead") sends every request to the wrong upstream path. Depending on the upstream, that is either a wave of 404s for a route that looks correctly configured, or -- worse -- silently hitting a different, unintended endpoint on the upstream if one happens to exist at the wrong path.

Problem

rewrite_path()'s docstring says the order is strip_prefix -> regex rewrite -> add_prefix. The code applies add_prefix first, then strip_prefix, then the regex rewrite -- the exact opposite order for the first two steps.

Current behavior

For a route with strip_prefix="/api" and add_prefix="/v2", a request for /api/widgets becomes /v2/api/widgets instead of , because is applied to the original path before runs, and 's check then silently finds nothing to strip.

Expected behavior

For a route with strip_prefix="/api" and add_prefix="/v2", a request for /api/widgets becomes upstream path /v2/widgets -- strip the external prefix first, then add the internal one.

Steps to reproduce

Configure a route with transform: {strip_prefix: "/api", add_prefix: "/v2"}.
Request /api/widgets through the gateway.
Observe the upstream receives /v2/api/widgets. Expected: /v2/widgets.

Why this matters

Because add_prefix runs first, the subsequent strip_prefix check silently no-ops instead of failing loudly -- the path just ends up wrong, with no error anywhere to point at the cause. Routes using only one of the two options never exercise the interaction at all, which is exactly why this kind of ordering bug survives: strip_prefix alone and add_prefix alone both still work fine.

Suggested approach

Compare the order of the three if blocks in rewrite_path() against the order stated in the docstring immediately above the function. One of them is out of place.

Acceptance criteria

strip_prefix="/api", add_prefix="/v2", path /api/widgets -> /v2/widgets
Using strip_prefix or add_prefix alone still behaves as before (no regression)
The regex rewrite still runs after both prefix operations

Verification

pytest practice_tickets/tests/test_ticket_06_transform_prefix_order.py -v

Hints (0/2)

Try it without hints first — the reading is the exercise.

Working on this ticket

Work on a branch named for the ticket — that's what you'll submit.

Branch off your fork

$git checkout -b fix/transform-prefix-order

Fix it and commit

Meet every acceptance criterion, and add a test that would have caught this.

Push the branch

$git push -u origin fix/transform-prefix-order

Submit it below

Paste your fork URL and the branch name, with a short write-up of the root cause.

Submit your fix

Questions

Stuck on something?

Ask about anything unclear in the ticket — the maintainer and anyone who has solved it can answer. Please don't post full solutions.

No questions yet. If something in this ticket reads ambiguously, you are probably not the only one — ask.

The project

Dynamic API Gateway & Reverse Proxy

A FastAPI reverse proxy that streams every request and response without ever buffering a body in full, with hot-reloadable routing, per-route auth, Redis token-bucket rate limiting, and a per-upstream circuit breaker.

Fork on GitHub

Download

Setup

Dynamic API Gateway & Reverse Proxy

git clone <your-fork>
cd FastAPIDevTraining/gateway_proxy
cp .env.example .env   # adjust GATEWAY_ADMIN_TOKEN etc. if you like
docker compose up --build   # Redis + the gateway (uvicorn --reload) + 2 demo upstreams

The gateway is reachable at . Two demo upstreams come up alongside it — (low-latency JSON echo at , plus for the streaming-passthrough demo) and (, , for timeout and circuit-breaker demos) — and wires five example routes against them, one per feature. Verify the stack with (liveness only) and (pings Redis, which every rate-limited route depends on). Every endpoint (route CRUD, reload, persist, breaker snapshot) requires .