Starlette 1.6.0

Apply the Python 3 prompt first. Target Starlette 1.6.0 on a maintained Python 3.10–3.14 runtime. These rules address Starlette's ASGI boundaries and APIs; retain the baseline controls for database queries, outbound requests, dependencies, and secrets.

Routing, middleware, and proxy trust

• Declare Route, Mount, and Host entries in trusted code, put specific paths before catch-all routes, and specify permitted HTTP methods. A route permitting GET also accepts HEAD; HTTPEndpoint can dispatch HEAD to get(). Apply the same authorization and keep both methods free of state changes.
• Cover every protected mount, host, static subtree, fallback, and WebSocketRoute with authorization. Middleware attached to one route or mount does not protect siblings; a bare Router does not supply the Starlette application's default error middleware.
• Review the actual stack: ServerErrorMiddleware, optional application RequestBodyLimitMiddleware, user middleware in list order, then ExceptionMiddleware and routing. Place SessionMiddleware before AuthenticationMiddleware when the backend reads sessions. Return denial responses directly from application middleware instead of relying on endpoint HTTPException handling.
• Use pure ASGI middleware for controls that must cover both http and websocket scopes, and pass lifespan through. BaseHTTPMiddleware handles HTTP only and prevents endpoint ContextVar changes from propagating back to outer middleware; do not base authorization or audit identity on that propagation.
• Keep connection-specific identity,