Starlette
Lightweight ASGI framework and toolkit for building async Python web services. Starlette provides routing, middleware, WebSockets, background tasks, static files, and a test client. FastAPI is built on top of Starlette. Used directly when you want FastAPI's foundation without FastAPI's dependency injection and OpenAPI layer — maximum performance with full async support.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
No built-in security headers — add SecurityHeadersMiddleware or configure Nginx. CORS requires CORSMiddleware configuration. Input validation is developer responsibility unlike FastAPI.
⚡ Reliability
Best When
You want maximum control over an async Python web service with ASGI fundamentals, or you're extending FastAPI with custom Starlette middleware.
Avoid When
You need automatic OpenAPI docs, dependency injection, and request validation — use FastAPI directly.
Use Cases
- • Build high-performance async Python APIs with full ASGI support for HTTP/2, WebSockets, and server-sent events
- • Use as the foundation for custom frameworks or extend FastAPI with Starlette middleware
- • Implement WebSocket endpoints alongside HTTP routes in the same ASGI application
- • Run background tasks after HTTP responses with BackgroundTasks for fire-and-forget operations
- • Use Starlette TestClient for testing async endpoints without running a live server
Not For
- • Applications needing dependency injection and automatic OpenAPI — use FastAPI which adds these on top of Starlette
- • Teams unfamiliar with ASGI — Flask is more approachable for beginners
- • ORM, auth, and admin functionality — Starlette is a toolkit, not batteries-included
Interface
Authentication
Toolkit with no built-in auth. Implement via Starlette Middleware or use with FastAPI's dependency injection.
Pricing
Free and open source, maintained by Encode and the community (Tom Christie).
Agent Metadata
Known Gotchas
- ⚠ Starlette route handlers must be async def or regular def — mixing sync routes blocks the event loop; use run_in_executor for CPU-bound sync operations
- ⚠ Middleware execution order: outer middleware wraps inner — add middleware in reverse order of intended execution; first added = outermost = first to run on request
- ⚠ WebSocket connections require explicit accept(), receive(), and send() calls — closing without explicit close() may leave connections hanging
- ⚠ Request body can only be read once — reading request.body() or request.json() consumes the stream; subsequent reads return empty; use body caching middleware if multiple reads needed
- ⚠ Starlette's TestClient is synchronous despite the async app — it uses threading internally; avoid using TestClient in async test functions without pytest-anyio handling
- ⚠ StaticFiles mounting requires exact path matching — mount('/static', StaticFiles(directory='static')) serves files at /static/file.ext, not /static/subdir/file.ext without directory=True
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Starlette.
Scores are editorial opinions as of 2026-03-06.