# Feature catalog — encode/starlette

> Canonical page: https://codevetter.com/unpack/starlette/feature-catalog

# Feature catalog — encode/starlette

Scanned commit 4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The public surface centers on developer APIs for composing web services. Routing supports function endpoints, endpoint classes, mounted applications, typed parameters, method restrictions, and reverse URLs. Requests, responses, WebSockets, rendering, authentication, and middleware provide the main service capabilities. Lifecycle handlers, background callbacks, configuration, and an in-process client complete the inspected toolkit.
- Route supports typed path matching, names, method sets, automatic HEAD inclusion for GET, per-route middleware, and body limits; HTTPEndpoint dispatches method handlers including QUERY and falls back from HEAD to get. — [starlette/routing.py#L199-L282](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/routing.py#L199-L282) [starlette/endpoints.py#L17-L55](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/endpoints.py#L17-L55)
- Request exposes URLs, headers, repeated query parameters, cookies, client addresses, streamed or buffered bodies, JSON, and forms; Config resolves prefixed environment values before file values and defaults, with optional casts. — [starlette/requests.py#L105-L167](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/requests.py#L105-L167) [starlette/requests.py#L234-L311](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/requests.py#L234-L311) [starlette/datastructures.py#L378-L402](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/datastructures.py#L378-L402) [starlette/config.py#L94-L140](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/config.py#L94-L140)
- Response variants supply HTML, text, compact JSON, redirects, streaming, and files; cookie APIs support expiry, Secure, HttpOnly, SameSite, and partitioning, with Response.set_cookie partitioning restricted to Python >=3.14. — [starlette/responses.py#L90-L155](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/responses.py#L90-L155) [starlette/responses.py#L176-L243](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/responses.py#L176-L243) [starlette/responses.py#L299-L342](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/responses.py#L299-L342)
- WebSocket supports acceptance with subprotocols and headers, text/bytes/JSON send and receive, asynchronous iterators, close reasons, and HTTP denial responses when the server advertises websocket.http.response. — [starlette/websockets.py#L106-L193](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/websockets.py#L106-L193)
- StaticFiles serves configured directories or package assets with HTML index/404 handling and conditional responses; Jinja2Templates adds rendering and context processors, while SchemaGenerator builds OpenAPI paths from YAML docstrings and gates QUERY on OpenAPI >=3.2. — [starlette/staticfiles.py#L40-L86](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/staticfiles.py#L40-L86) [starlette/staticfiles.py#L115-L193](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/staticfiles.py#L115-L193) [starlette/templating.py#L117-L156](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/templating.py#L117-L156) [starlette/schemas.py#L98-L152](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/schemas.py#L98-L152)
- AuthenticationMiddleware delegates identity to an AuthenticationBackend and exposes auth/user through scope; requires enforces scopes with HTTP errors or named-route redirects, while SessionMiddleware provides signed cookie sessions. — [starlette/middleware/authentication.py#L16-L52](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/authentication.py#L16-L52) [starlette/authentication.py#L25-L98](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/authentication.py#L25-L98) [starlette/middleware/sessions.py#L16-L91](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/sessions.py#L16-L91)
- Middleware includes CORS preflight/private-network policy, GZip negotiation and media exclusions, trusted-host validation, HTTPS/WSS redirection, total request-body limits, and experimental OpenTelemetry HTTP spans. — [starlette/middleware/cors.py#L15-L145](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/cors.py#L15-L145) [starlette/middleware/gzip.py#L12-L78](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/gzip.py#L12-L78) [starlette/middleware/trustedhost.py#L13-L66](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/trustedhost.py#L13-L66) [starlette/middleware/opentelemetry.py#L18-L30](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/middleware/opentelemetry.py#L18-L30)
- Lifespan context managers manage startup/shutdown resources; BackgroundTask and BackgroundTasks attach post-response callbacks, and TestClient offers synchronous HTTP calls, WebSocket sessions, asyncio/trio backends, and lifecycle management. — [starlette/routing.py#L645-L670](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/routing.py#L645-L670) [starlette/background.py#L12-L36](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/background.py#L12-L36) [starlette/testclient.py#L384-L410](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/testclient.py#L384-L410) [starlette/testclient.py#L473-L562](https://github.com/encode/starlette/blob/4e7fc04e5f2c69f60e418ff2107d0f6d9a0fe423/starlette/testclient.py#L473-L562)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)