starlette HTTPConnection::__get_item_

The Fix

Upgrade to version 0.17.0 or later.

Based on closed Kludex/starlette issue #1117 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -65,7 +65,7 @@ def __init__(self, scope: Scope, receive: Receive = None) -> None:
         self.scope = scope
 
-    def __getitem__(self, key: str) -> str:
+    def __getitem__(self, key: str) -> typing.Any:
         return self.scope[key]

repro.py

from starlette.types import Scope, Receive, Send
from starlette.websockets import WebSocket


async def app(scope: Scope, receive: Receive, send: Send) -> None:
    websocket = WebSocket(scope=scope, receive=receive, send=send)
    await websocket.accept()
    ip, port = websocket['client']  # mypy fails to typecheck, because websocket['client'] typed as a str
    # Succeeds at runtime, because websocket['client'] is not a string
    assert isinstance(ip, str)
    assert isinstance(port, int)

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.17.0 or later.\nWhen NOT to use: This fix is not applicable if the return type must remain strictly as str for compatibility.\n\n

Why This Fix Works in Production

Trigger: HTTPConnection::__get_item__ has incorrect type signature
Mechanism: The return type of HTTPConnection's __getitem__ method was incorrectly specified as str instead of Any
Why the fix works: The type signature of HTTPConnection's __getitem__ method was updated to return Any instead of str, aligning it with the actual data types in the connection scope. (first fixed release: 0.17.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The return type of HTTPConnection's __getitem__ method was incorrectly specified as str instead of Any
Production symptom (often without a traceback): HTTPConnection::__get_item__ has incorrect type signature

Proof / Evidence

GitHub issue: #1117
Fix PR: https://github.com/kludex/starlette/pull/1118
First fixed release: 0.17.0
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.61

Verified Execution

We executed the runnable minimal repro in a temporary environment and captured exit codes + logs.

Status: PASS
Ran: 2026-02-11T16:52:29Z
Package: starlette
Fixed: 0.17.0
Mode: fixed_only
Outcome: ok

Logs

affected (exit=None)

fixed (exit=0)

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“### Checklist  - [x] The bug is reproducible against the latest release and/or master. - [x] There are no similar issues or pull requests to fix it yet. #”

Issue thread · issue description · source

Failure Signature (Search String)

HTTPConnection::__get_item__ has incorrect type signature
ip, port = websocket['client'] # mypy fails to typecheck, because websocket['client'] typed as a str

Copy-friendly signature

signature.txt

Failure Signature
-----------------
HTTPConnection::__get_item__ has incorrect type signature
ip, port = websocket['client']  # mypy fails to typecheck, because websocket['client'] typed as a str

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
HTTPConnection::__get_item__ has incorrect type signature
ip, port = websocket['client']  # mypy fails to typecheck, because websocket['client'] typed as a str

Minimal Reproduction

repro.py

from starlette.types import Scope, Receive, Send
from starlette.websockets import WebSocket


async def app(scope: Scope, receive: Receive, send: Send) -> None:
    websocket = WebSocket(scope=scope, receive=receive, send=send)
    await websocket.accept()
    ip, port = websocket['client']  # mypy fails to typecheck, because websocket['client'] typed as a str
    # Succeeds at runtime, because websocket['client'] is not a string
    assert isinstance(ip, str)
    assert isinstance(port, int)

What Broke

Mypy fails to typecheck valid code due to incorrect type signature, causing development delays.

Why It Broke

The return type of HTTPConnection's __getitem__ method was incorrectly specified as str instead of Any

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.17.0 or later.

When NOT to use: This fix is not applicable if the return type must remain strictly as str for compatibility.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Option D — Guard side-effects with OnceOnly Guardrail for side-effects

Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.

Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.

Show example snippet (optional)

onceonly.py

from onceonly import OnceOnly
import os

once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True)

# Stable idempotency key per real side-effect.
# Use a request id / job id / webhook delivery id / Stripe event id, etc.
event_id = "evt_..."  # replace
key = f"stripe:webhook:{event_id}"

res = once.check_lock(key=key, ttl=3600)
if res.duplicate:
    return {"status": "already_processed"}

# Safe to execute the side-effect exactly once.
handle_event(event_id)

See OnceOnly SDK

When NOT to use: Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Fix reference: https://github.com/kludex/starlette/pull/1118

First fixed release: 0.17.0

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the return type must remain strictly as str for compatibility.
Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
Pin production dependencies and upgrade only with a reproducible test that hits the failing path.

Version Compatibility Table

Version	Status
0.17.0	Fixed

Related Issues

No related fixes found.

Cluster: starlette:configuration-error All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

starlette HTTPConnection::__get_item__ has incorrect type signature (Fix)