httpx Clearing authorization at the request level. (Fix)

The Fix

Upgrade to version 0.14.2 or later.

Based on closed encode/httpx issue #1004 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -284,8 +284,10 @@ def _merge_queryparams(
         return params
 
-    def _build_auth(self, request: Request, auth: AuthTypes = None) -> Auth:
-        auth = self.auth if auth is None else auth
+    def _build_auth(

repro.py

>> import requests
>> s = requests.Session()
>> s.auth = ("john", "admin")
>> url = "https://httpbin.org/headers"
>> r = s.get(url, auth=None)
>> r.json()["headers"]["Authorization"]
'Basic am9objphZG1pbg=='

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.14.2 or later.\nWhen NOT to use: This fix is not applicable if the behavior of using client-level auth is desired.\n\n

Why This Fix Works in Production

Trigger: Merging of request-level auth *unset* does not take priority over Client level value.
Mechanism: The request-level auth unset does not override the client-level auth value
Why the fix works: Allows disabling authorization at the request level by treating `auth=None` as 'no auth on this request'. (first fixed release: 0.14.2).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The request-level auth unset does not override the client-level auth value
Production symptom (often without a traceback): Merging of request-level auth *unset* does not take priority over Client level value.

Proof / Evidence

GitHub issue: #1004
Fix PR: https://github.com/encode/httpx/pull/1115
First fixed release: 0.14.2
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.69

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“> Then at request time we can safely use None to signify "no auth"? Only if we changed the .request() signature. Otherwise there's no way…”

@lovelydinosaur · 2020-05-29 · source

“> Alternately we could change them to some sentinel empty value, so eg params = EMPTY, but that's a big awkward. I was thinking on…”

@yeraydiazdiaz · 2020-05-29 · source

“I was going to suggest .build_request()/.send() as a workaround, but as expected it won't work either — the "use client auth if request auth is…”

@florimondmanca · 2020-05-29 · source

“Can we use a decorator to evaluate signature data before set?”

@cansarigol · 2020-05-30 · source

Failure Signature (Search String)

Merging of request-level auth *unset* does not take priority over Client level value.
assert 'Authorization' not in r.request.headers['Authorization']

Copy-friendly signature

signature.txt

Failure Signature
-----------------
Merging of request-level auth *unset* does not take priority over Client level value.
assert 'Authorization' not in r.request.headers['Authorization']

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
Merging of request-level auth *unset* does not take priority over Client level value.
assert 'Authorization' not in r.request.headers['Authorization']

Minimal Reproduction

repro.py

>> import requests
>> s = requests.Session()
>> s.auth = ("john", "admin")
>> url = "https://httpbin.org/headers"
>> r = s.get(url, auth=None)
>> r.json()["headers"]["Authorization"]
'Basic am9objphZG1pbg=='

What Broke

Authorization headers are incorrectly sent even when unset at the request level.

Why It Broke

The request-level auth unset does not override the client-level auth value

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.14.2 or later.

When NOT to use: This fix is not applicable if the behavior of using client-level auth is desired.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/encode/httpx/pull/1115

First fixed release: 0.14.2

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the behavior of using client-level auth is desired.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Make timeouts explicit and test them (unit + integration) to avoid silent behavior changes.
Instrument retries (attempt count + reason) and alert on spikes to catch dependency slowdowns.

Version Compatibility Table

Version	Status
0.14.2	Fixed

Related Issues

No related fixes found.

Cluster: httpx:configuration-error All hubs All clusters

Related clusters: Data consistency Other Timeout

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.