Starlette

middleware

Starlette is the ASGI toolkit under FastAPI: routing, middleware, websockets, background tasks and a test client. No validation layer, no dependency injection - FastAPI supplies those on top.

Its governance, ownership and the 1.0 milestone are covered on Python Web Frameworks. This page is what bites when you use it.

Checked against Starlette 1.4.x.

BaseHTTPMiddleware breaks contextvars

The most expensive gotcha here, because the symptom appears somewhere other than the cause.

Middleware is evaluated top to bottom, wrapped by ServerErrorMiddleware outermost and ExceptionMiddleware innermost. That part is predictable. What is not: “Using BaseHTTPMiddleware will prevent changes to contextvars.ContextVars from propagating upwards.”

So a ContextVar set inside an endpoint is not readable from middleware sitting above a BaseHTTPMiddleware. Worse, the damage is not local - “if a BaseHTTPMiddleware is positioned earlier in the middleware stack, it will disrupt contextvars propagation for any subsequent Pure ASGI Middleware that relies on them.” One convenient middleware silently disables correlation IDs, request-scoped tenancy or structured-logging context for everything below it.

The documented answer is to write pure ASGI middleware instead. BaseHTTPMiddleware is the comfortable subclass; it is also the one with the caveat.

Request-parsing hardening, and what pinning costs

Most of the 1.3.x and 1.4.x work has been denial-of-service hardening on request parsing: max_fields and max_part_size enforcement in FormParser, absolute-path rejection in StaticFiles, suffix-range clamping in FileResponse, and GZip offloading.

That is the argument against pinning Starlette low to keep an old FastAPI: the fixes are in the layer that touches untrusted input first. FastAPI depends on starlette>=0.46.0 with no upper bound, so it accepts the 1.x line.

TestClient

TestClient now emits a deprecation warning for plain httpx, which is the visible edge of a larger shift - httpx stalled and was superseded by pydantic/httpx2. See Python Web Frameworks.

Notes

  • Ships py.typed. It does not do type-hint-driven validation or dependency injection; that is FastAPI’s layer.

  • encode/uvicorn moved to Kludex/uvicorn alongside Starlette, and both are active. What stayed at encode did not: databases, orm, typesystem and broadcaster are archived.

  • https://www.starlette.io/

Related