The Fix
Upgrade to version 0.7.3 or later.
Based on closed encode/httpx issue #345 · PR/commit linked
@@ -40,6 +40,7 @@
WriteTimeout,
)
+from .middleware.digest_auth import DigestAuth
from .models import (
URL,
repro.py
from httpx_oauthlib import OAuth2Dispatch
from starlette.applications import Starlette
from starlette.responses import RedirectResponse, JSONResponse
from starlette.middleware.session import SessionMiddleware
app = Starlette()
app.add_middleware(SessionMiddleware)
# This information is obtained upon registration of a new GitHub
client_id = "<your client key>"
client_secret = "<your client secret>"
authorization_base_url = 'https://github.com/login/oauth/authorize'
token_url = 'https://github.com/login/oauth/access_token'
@app.route("/login")
async def login(request):
github = OAuth2Dispatch(client_id)
authorization_url, state = github.authorization_url(authorization_base_url)
# State is used to prevent CSRF, keep this for later.
request.session['oauth_state'] = state
return RedirectResponse(url=authorization_url)
@app.route("/callback")
async def callback(request):
github = OAuth2Dispatch(client_id, state=session['oauth_state'])
token = await github.fetch_token(token_url, client_secret=client_secret, authorization_response=request.url)
r = await github.request("GET", "https://api.github.com/user")
return JSONResponse(r.json())
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\nUpgrade to version 0.7.3 or later.\nWhen NOT to use: This fix is not suitable if backward compatibility with existing middleware is a concern.\n\n
Why This Fix Works in Production
- Trigger: authorization_base_url = 'https://github.com/login/oauth/authorize'
- Mechanism: The internal middleware API was not exposed for public use, limiting extensibility
- Why the fix works: Introduces a callable-based middleware interface, allowing users to implement middleware for the HTTPX client. (first fixed release: 0.7.3).
Why This Breaks in Prod
- The internal middleware API was not exposed for public use, limiting extensibility
- Production symptom (often without a traceback): authorization_base_url = 'https://github.com/login/oauth/authorize'
Proof / Evidence
- GitHub issue: #345
- Fix PR: https://github.com/encode/httpx/pull/332
- First fixed release: 0.7.3
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.75
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.50
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@kesavkolla I think what you need is something like <https://docs.authlib.org/en/latest/client/httpx.html> Stay tuned, Authlib HTTPX feature is not released yet, it will be released in v0.13.”
“Yes this would be a great help. Specially I'm looking for an usecase for supporting OAuth2. I want the middleware ability so that I can…”
“@kesavkolla Actually, the auth parameter also accepts a request -> request callable to modify the request before sending it (this is not yet properly documented,…”
“It's not just injecting the header. There can be more auth flow that need to be executed. If token is expired need to call an…”
Failure Signature (Search String)
- authorization_base_url = 'https://github.com/login/oauth/authorize'
Copy-friendly signature
signature.txt
Failure Signature
-----------------
authorization_base_url = 'https://github.com/login/oauth/authorize'
Error Message
Signature-only (no traceback captured)
error.txt
Error Message
-------------
authorization_base_url = 'https://github.com/login/oauth/authorize'
Minimal Reproduction
repro.py
from httpx_oauthlib import OAuth2Dispatch
from starlette.applications import Starlette
from starlette.responses import RedirectResponse, JSONResponse
from starlette.middleware.session import SessionMiddleware
app = Starlette()
app.add_middleware(SessionMiddleware)
# This information is obtained upon registration of a new GitHub
client_id = "<your client key>"
client_secret = "<your client secret>"
authorization_base_url = 'https://github.com/login/oauth/authorize'
token_url = 'https://github.com/login/oauth/access_token'
@app.route("/login")
async def login(request):
github = OAuth2Dispatch(client_id)
authorization_url, state = github.authorization_url(authorization_base_url)
# State is used to prevent CSRF, keep this for later.
request.session['oauth_state'] = state
return RedirectResponse(url=authorization_url)
@app.route("/callback")
async def callback(request):
github = OAuth2Dispatch(client_id, state=session['oauth_state'])
token = await github.fetch_token(token_url, client_secret=client_secret, authorization_response=request.url)
r = await github.request("GET", "https://api.github.com/user")
return JSONResponse(r.json())
What Broke
Users cannot implement custom middleware, leading to limited functionality.
Why It Broke
The internal middleware API was not exposed for public use, limiting extensibility
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 0.7.3 or later.
When NOT to use: This fix is not suitable if backward compatibility with existing middleware is a concern.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/encode/httpx/pull/332
First fixed release: 0.7.3
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not suitable if backward compatibility with existing middleware is a concern.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Track RSS + object counts after deployments; alert on monotonic growth and GC pressure.
- Add a long-running test that repeats the failing call path and asserts stable memory.
Version Compatibility Table
| Version | Status |
|---|---|
| 0.7.3 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.