The Fix
Upgrade to version 0.19.0 or later.
Based on closed Kludex/starlette issue #1261 · PR/commit linked
Production note: Watch p95/p99 latency and retry volume; timeouts can turn into retry storms and duplicate side-effects.
@@ -17,6 +17,7 @@ def __init__(
session_cookie: str = "session",
max_age: typing.Optional[int] = 14 * 24 * 60 * 60, # 14 days, in seconds
+ path: str = "/",
same_site: str = "lax",
https_only: bool = False,
repro.py
# Routes
routes = [
Route("/", main_pages.homepage, name="dashboard", methods=["GET", "POST"]),
Route("/about", main_pages.about_page, methods=["GET"]),
Mount("/user", routes=
[
Route(
"/forgot", routes=user_pages.forgot_password, methods=["GET", "POST"]
),
Route("/login", routes=user_pages.login, methods=["GET", "POST"]),
Route("/logout", routes=user_pages.logout, methods=["GET", "POST"]),
Route(
"/password-change",
routes=user_pages.password_change,
methods=["GET", "POST"],
),
Route("/profile", routes=user_pages.profile, methods=["GET"]),
Route("/register", routes=user_pages.register, methods=["GET", "POST"]),
],
name="user",
),
# Session Checking
def require_login(endpoint: Callable) -> Callable:
async def check_login(request: Request) -> Response:
if "user_name" not in request.session:
logger.error(
f"user page access without being logged in from {request.client.host}"
)
return RedirectResponse(url="/user/login", status_code=303)
else:
one_twenty = datetime.now() - timedelta(
minutes=config_settings.login_timeout
)
current: bool = one_twenty < datetime.strptime(
request.session["updated"], "%Y-%m-%d %H:%M:%S.%f"
)
if current == False:
logger.error(
f"user {request.session['user_name']} outside window: {current}"
)
return RedirectResponse(url="/user/login", status_code=303)
# update datetime of last use
logger.info(
f"user {request.session['id']} within timeout window: {current}"
)
request.session["updated"] = str(datetime.now())
return await endpoint(request)
return check_login
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\nUpgrade to version 0.19.0 or later.\nWhen NOT to use: This fix is not suitable if the application does not require session persistence across subroutes.\n\n
Why This Fix Works in Production
- Trigger: Starlette 0.15.0 breaks SessionMiddleware by adding ASGI Path for Subroutes using Mount
- Mechanism: Reverts a previous change that broke session handling in SessionMiddleware when using Mount.
- Why the fix works: Reverts a previous change that broke session handling in SessionMiddleware when using Mount. (first fixed release: 0.19.0).
Production impact:
- If left unfixed, this can cause silent data inconsistencies that propagate (bad cache entries, incorrect downstream decisions).
Why This Breaks in Prod
- Triggered by an upgrade/regression window: 3.8 breaks; 0.19.0 is the first fixed release.
- Production symptom (often without a traceback): Starlette 0.15.0 breaks SessionMiddleware by adding ASGI Path for Subroutes using Mount
Proof / Evidence
- GitHub issue: #1261
- Fix PR: https://github.com/kludex/starlette/pull/1512
- First fixed release: 0.19.0
- Affected versions: 3.8
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.46
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“I was able to reproduce this issue in a notebook: tinnable.com/tins/11ccfe75-e709-47ee-b085-f1755e844bef. It follows @devsetgo's case closely. Hope this is helpful.”
“I bumped into this myself as well. Taking a look…”
“Hi all, Just got bit by this too. Thankfully found this issue. Removing Mount() and specifying individual Route() will fix the error.”
“Hello everyone, I've bumped into this one as well. Could you, please, fix this bug the sooner the better. Thank you in advance.”
Failure Signature (Search String)
- Starlette 0.15.0 breaks SessionMiddleware by adding ASGI Path for Subroutes using Mount
- "/password-change",
Copy-friendly signature
signature.txt
Failure Signature
-----------------
Starlette 0.15.0 breaks SessionMiddleware by adding ASGI Path for Subroutes using Mount
"/password-change",
Error Message
Signature-only (no traceback captured)
error.txt
Error Message
-------------
Starlette 0.15.0 breaks SessionMiddleware by adding ASGI Path for Subroutes using Mount
"/password-change",
Minimal Reproduction
repro.py
# Routes
routes = [
Route("/", main_pages.homepage, name="dashboard", methods=["GET", "POST"]),
Route("/about", main_pages.about_page, methods=["GET"]),
Mount("/user", routes=
[
Route(
"/forgot", routes=user_pages.forgot_password, methods=["GET", "POST"]
),
Route("/login", routes=user_pages.login, methods=["GET", "POST"]),
Route("/logout", routes=user_pages.logout, methods=["GET", "POST"]),
Route(
"/password-change",
routes=user_pages.password_change,
methods=["GET", "POST"],
),
Route("/profile", routes=user_pages.profile, methods=["GET"]),
Route("/register", routes=user_pages.register, methods=["GET", "POST"]),
],
name="user",
),
# Session Checking
def require_login(endpoint: Callable) -> Callable:
async def check_login(request: Request) -> Response:
if "user_name" not in request.session:
logger.error(
f"user page access without being logged in from {request.client.host}"
)
return RedirectResponse(url="/user/login", status_code=303)
else:
one_twenty = datetime.now() - timedelta(
minutes=config_settings.login_timeout
)
current: bool = one_twenty < datetime.strptime(
request.session["updated"], "%Y-%m-%d %H:%M:%S.%f"
)
if current == False:
logger.error(
f"user {request.session['user_name']} outside window: {current}"
)
return RedirectResponse(url="/user/login", status_code=303)
# update datetime of last use
logger.info(
f"user {request.session['id']} within timeout window: {current}"
)
request.session["updated"] = str(datetime.now())
return await endpoint(request)
return check_login
What Broke
Session data is lost when redirecting back to the start page after using Mount.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 0.19.0 or later.
When NOT to use: This fix is not suitable if the application does not require session persistence across subroutes.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Option D — Guard side-effects with OnceOnly Guardrail for side-effects
Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.
- Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
- Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
- Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.
- This does NOT fix data corruption; it only prevents duplicate side-effects.
Show example snippet (optional)
onceonly.py
from onceonly import OnceOnly
import os
once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True)
# Stable idempotency key per real side-effect.
# Use a request id / job id / webhook delivery id / Stripe event id, etc.
event_id = "evt_..." # replace
key = f"stripe:webhook:{event_id}"
res = once.check_lock(key=key, ttl=3600)
if res.duplicate:
return {"status": "already_processed"}
# Safe to execute the side-effect exactly once.
handle_event(event_id)
When NOT to use: Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.
Fix reference: https://github.com/kludex/starlette/pull/1512
First fixed release: 0.19.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not suitable if the application does not require session persistence across subroutes.
- Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
- Make timeouts explicit and test them (unit + integration) to avoid silent behavior changes.
- Instrument retries (attempt count + reason) and alert on spikes to catch dependency slowdowns.
Version Compatibility Table
| Version | Status |
|---|---|
| 3.8 | Broken |
| 0.19.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.