The Fix
Upgrade to version 0.28.0 or later.
Based on closed Kludex/starlette issue #2152 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -1,4 +1,5 @@
@@ -1,4 +1,5 @@
import itertools
+import sys
from asyncio import current_task as asyncio_current_task
from contextlib import asynccontextmanager
repro.py
from starlette.responses import Response
from starlette.testclient import TestClient
async def app(scope, receive, send):
response = Response("foo")
response.set_cookie("bar", "baz", domain="testserver")
await response(scope, receive, send)
def test_app():
client = TestClient(app)
response = client.get("/")
assert len(response.cookies) == 1
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\nUpgrade to version 0.28.0 or later.\nWhen NOT to use: This fix is not applicable if the default base_url is changed in existing tests.\n\nOption C — Workaround\n** Use `testserver.local` as cookie domain for testclient. This works fine in both Python 3.10 and Python 3.11.\nWhen NOT to use: This fix is not applicable if the default base_url is changed in existing tests.\n\n
Why This Fix Works in Production
- Trigger: Testclient doesn't accept cookies with domain "testserver" in Python < 3.11
- Mechanism: Adds a test for domain restricted cookies in the starlette testclient, which fails in Python 3.10 and below due to cookie domain handling changes.
- Why the fix works: Adds a test for domain restricted cookies in the starlette testclient, which fails in Python 3.10 and below due to cookie domain handling changes. (first fixed release: 0.28.0).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.11 in real deployments (not just unit tests).
- Production symptom (often without a traceback): Testclient doesn't accept cookies with domain "testserver" in Python < 3.11
Proof / Evidence
- GitHub issue: #2152
- Fix PR: https://github.com/kludex/starlette/pull/2154
- First fixed release: 0.28.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.66
Verified Execution
We executed the runnable minimal repro in a temporary environment and captured exit codes + logs.
- Status: PASS
- Ran: 2026-02-11T16:52:29Z
- Package: starlette
- Fixed: 0.28.0
- Mode: fixed_only
- Outcome: ok
Logs
affected (exit=None)
fixed (exit=0)
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“Thanks, I also stumbled upon the problem and this helped me a lot. Would be really good if this was in the documentation! (still on…”
“Can you create a test with this behavior, please?”
“> Can you create a test with this behavior, please? Ok, done in #2154. Note that this just adds a testcase (which fails in Python…”
Failure Signature (Search String)
- Testclient doesn't accept cookies with domain "testserver" in Python < 3.11
- assert len(response.cookies) == 1
Copy-friendly signature
signature.txt
Failure Signature
-----------------
Testclient doesn't accept cookies with domain "testserver" in Python < 3.11
assert len(response.cookies) == 1
Error Message
Signature-only (no traceback captured)
error.txt
Error Message
-------------
Testclient doesn't accept cookies with domain "testserver" in Python < 3.11
assert len(response.cookies) == 1
Minimal Reproduction
repro.py
from starlette.responses import Response
from starlette.testclient import TestClient
async def app(scope, receive, send):
response = Response("foo")
response.set_cookie("bar", "baz", domain="testserver")
await response(scope, receive, send)
def test_app():
client = TestClient(app)
response = client.get("/")
assert len(response.cookies) == 1
Environment
- Python: 3.11
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 0.28.0 or later.
When NOT to use: This fix is not applicable if the default base_url is changed in existing tests.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Option C — Workaround Temporary workaround
** Use `testserver.local` as cookie domain for testclient. This works fine in both Python 3.10 and Python 3.11.
When NOT to use: This fix is not applicable if the default base_url is changed in existing tests.
Use only if you cannot change versions today. Treat this as a stopgap and remove once upgraded.
Option D — Guard side-effects with OnceOnly Guardrail for side-effects
Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.
- Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
- Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
- Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.
Show example snippet (optional)
onceonly.py
from onceonly import OnceOnly
import os
once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True)
# Stable idempotency key per real side-effect.
# Use a request id / job id / webhook delivery id / Stripe event id, etc.
event_id = "evt_..." # replace
key = f"stripe:webhook:{event_id}"
res = once.check_lock(key=key, ttl=3600)
if res.duplicate:
return {"status": "already_processed"}
# Safe to execute the side-effect exactly once.
handle_event(event_id)
When NOT to use: Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.
Fix reference: https://github.com/kludex/starlette/pull/2154
First fixed release: 0.28.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not applicable if the default base_url is changed in existing tests.
- Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Version Compatibility Table
| Version | Status |
|---|---|
| 0.28.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.