Starlette 1.7.0

Apply the Python baseline first, then these rules for Starlette 1.7.0 on maintained stable CPython 3.11–3.15 with anyio>=4.0.0,<5.

Deployment and middleware

• Keep Starlette(debug=False) in production and install a safe 500 handler; enabling debug replaces that handler's response with a traceback.
• Install TrustedHostMiddleware with explicit allowed_hosts before middleware that constructs redirects or absolute URLs. Its default allowed_hosts=None permits every host; use bracketed IPv6 entries and enable www_redirect only when that redirect is intended.
• Establish the external scheme and client address only through trusted proxy configuration before using request.url, request.client, or HTTPSRedirectMiddleware. With Uvicorn, restrict --forwarded-allow-ips to actual proxies and prevent direct access that would defeat that trust boundary.
• Require TLS for both HTTP and WebSocket traffic; HTTPSRedirectMiddleware redirects http and ws but does not terminate TLS. Validate hosts before redirects and configure proxy forwarding so the app sees the original secure scheme.
• Apply authentication and other mandatory controls around every relevant Mount and standalone ASGI application. A bare Router has no Starlette application middleware; BaseHTTPMiddleware covers HTTP only, so protect WebSocket routes explicitly.
• Keep request-specific identity and policy state local to the ASGI call or its scope, never on a shared middleware instance. Use pure ASGI middleware when correctness depends on ContextVar propagation; BaseHTTPMiddleware