Starlette 1.8

Apply to Starlette 1.8 applications and ASGI components on maintained CPython 3.11–3.15, with AnyIO 4. The Python baseline supplies language, dependency, password storage, injection-safe queries and token verification controls; apply them inside the framework boundaries below.

Application and deployment boundaries

• Construct production applications with debug=False; traceback responses override the configured 500 handler when debugging is enabled. Keep the ASGI http.response.debug extension out of production servers: TemplateResponse sends its template name and full context through it.
• Install security middleware on every exposed application, including separately served sub-applications. A plain Router runs only the middleware= it is given, without the application's error and exception handling layers.
• Put TrustedHostMiddleware ahead of HTTPSRedirectMiddleware, with explicit public hosts and intentional www_redirect behavior. Use bracketed IPv6 entries; allowing * removes host enforcement.
• Configure the ASGI server to trust forwarded scheme and client headers only from the actual proxy addresses. In Uvicorn, constrain --forwarded-allow-ips; an unrestricted value requires a network boundary that prevents direct client access.
• Build password-reset and callback origins from trusted configuration. Neither request.url, Host routing nor url_for() makes an incoming origin authoritative; apply destination validation before using it for redirects or outbound requests that could cause SSRF.
• Prefer route and endpoint authorization over path