Dependency is not being cached; dependency called multiple times

[nyte-owl]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from typing import Annotated, List

from fastapi import FastAPI, Depends, Header, Security, HTTPException, status
from fastapi.security import SecurityScopes
from pydantic import BaseModel

app = FastAPI()


class User(BaseModel):
    id: str
    name: str
    scopes: List[str]


def get_current_user_from_header(
    x_user_id: Annotated[str, Header(title="User ID")]
) -> User:
    print("Get user from header")
    # verify user in DB
    return User(id=x_user_id, name="Foo Bar", scopes=["admin"])


CurrentUser = Annotated[User, Depends(get_current_user_from_header)]


def verify_user_permissions(
    security_scopes: SecurityScopes,
    user: CurrentUser,
):
    for required_scope in security_scopes.scopes:
        if required_scope not in user.scopes:
            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)


@app.get("/", dependencies=[Security(verify_user_permissions, scopes=["admin"])])
async def root(current_user: CurrentUser):
    return {"message": f"Hello {current_user.name}"}

Description

I am trying to tell what's going wrong with my code example. I understand that dependencies are supposed to be cached per request so they are only solved one time for each request (docs link). However here's what happens:

• Open browser and call the endpoint '/'
• I expect the dependency get_current_user_from_header to be solved only once
• Instead, the get_current_user_from_header dependency is solved twice (print statement is displayed twice)

Operating System

Windows

Operating System Details

Issue is present on Windows or Linux

FastAPI Version

0.95.1

Python Version

3.10.1

Additional Context

No response

[jgould22]

I believe this may be related to the use of SecurityScopes

#6024

[nyte-owl]

Looks like this is due to change introduced for #2945. Not sure what the intent is for child Depends, as it doesn't seem like those should be affected by security_scopes when calculating cache_key, i.e. Depends objects should be cached regardless of scopes in parent Security Dependants.

[YuriiMotov]

We are discussing this issue here. I encourage you to join us and express your opinion