starlette RedirectResponse call to `quote

The Fix

Upgrade to version 0.15.0 or later.

Based on closed Kludex/starlette issue #1162 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -7,7 +7,7 @@
 from email.utils import formatdate
 from mimetypes import guess_type as mimetypes_guess_type
-from urllib.parse import quote, quote_plus
+from urllib.parse import quote

repro.py

from starlette.applications import Starlette
from starlette.responses import JSONResponse
from starlette.routing import Route


async def homepage(request):
    name = request.path_params["name"]
    return JSONResponse({"hello": name})


app = Starlette(routes=[Route("/{name}/greeting", homepage)])


from starlette.testclient import TestClient

client = TestClient(app)


def test_redirect_homepage():
    name = "bob%20ross"
    url = f"{name}/greeting"
    for u in [url, url + "/"]:
        resp = client.get(u)
        assert url in str(resp.url)

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.15.0 or later.\nWhen NOT to use: Do not use this fix if the application requires '+' to be preserved in URLs.\n\n

Why This Fix Works in Production

Trigger: In other words, remove anything that doesn't make the bug go away.
Mechanism: RedirectResponse incorrectly uses quote_plus, replacing spaces with '+' instead of '%20'
Why the fix works: Replaces the use of `quote_plus` with `quote` in the `RedirectResponse` location header to prevent spaces from being replaced with `+` characters. (first fixed release: 0.15.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

RedirectResponse incorrectly uses quote_plus, replacing spaces with '+' instead of '%20'
Production symptom (often without a traceback): In other words, remove anything that doesn't make the bug go away.

Proof / Evidence

GitHub issue: #1162
Fix PR: https://github.com/kludex/starlette/pull/1164
First fixed release: 0.15.0
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.75
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.58

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“@falkben a pull request would be appreciated”

@JayH5 · 2021-04-12 · source

“okay, i'll work on getting this information i did a quick look and flask does not seem to replace spaces for redirects but i'll and…”

@falkben · 2021-04-02 · source

“If you'd like I can submit a Pull Request to make the url quoting the same as Django/flask?”

@falkben · 2021-04-09 · source

“The best places to start with this would be: * Compare and contrast what we're doing here with alternative frameworks”

@lovelydinosaur · 2021-04-02 · source

Failure Signature (Search String)

In other words, remove anything that doesn't make the bug go away.
assert url in str(resp.url)

Copy-friendly signature

signature.txt

Failure Signature
-----------------
In other words, remove anything that doesn't make the bug go away.
assert url in str(resp.url)

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
In other words, remove anything that doesn't make the bug go away.
assert url in str(resp.url)

Minimal Reproduction

repro.py

from starlette.applications import Starlette
from starlette.responses import JSONResponse
from starlette.routing import Route


async def homepage(request):
    name = request.path_params["name"]
    return JSONResponse({"hello": name})


app = Starlette(routes=[Route("/{name}/greeting", homepage)])


from starlette.testclient import TestClient

client = TestClient(app)


def test_redirect_homepage():
    name = "bob%20ross"
    url = f"{name}/greeting"
    for u in [url, url + "/"]:
        resp = client.get(u)
        assert url in str(resp.url)

What Broke

RedirectResponse modifies URL paths, causing incorrect redirection behavior.

Why It Broke

RedirectResponse incorrectly uses quote_plus, replacing spaces with '+' instead of '%20'

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.15.0 or later.

When NOT to use: Do not use this fix if the application requires '+' to be preserved in URLs.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/kludex/starlette/pull/1164

First fixed release: 0.15.0

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if the application requires '+' to be preserved in URLs.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
0.15.0	Fixed

Related Issues

No related fixes found.

Cluster: starlette:configuration-error All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

starlette RedirectResponse call to `quote_plus` replaces spaces & `%20`'s with `+` character (Fix)