Requests Making requests to URLs with username and password

The Fix

pip install requests==2.27.0

Based on closed psf/requests issue #4158 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -182,3 +182,4 @@ Patches and Suggestions
 - Nehal J Wani (`@nehaljwani <https://github.com/nehaljwani>`_)
 - Demetrios Bairaktaris (`@DemetriosBairaktaris <https://github.com/demetriosbairaktaris>`_)
+- Darren Dormer (`@ddormer <https://github.com/ddormer>`_)
diff --git a/HISTORY.rst b/HISTORY.rst
index b099ecdb1b..db1d1f7043 100644

repro.py

import requests
import os

os.environ['https_proxy'] = #insert your proxy here
os.environ['no_proxy'] = 'localhost,127.0.0.1'

requests.get('https://username:password@localhost:8080/')

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install requests==2.27.0\nWhen NOT to use: Do not use this fix if authentication credentials are required for proxy access.\n\nOption C — Workaround\nproxies kwarg can be used to bypass this issue, e.g. by setting {'https': None}. Should be used with caution.\nWhen NOT to use: Do not use this fix if authentication credentials are required for proxy access.\n\n

Why This Fix Works in Production

Trigger: OSError: Tunnel connection failed: 504 Gateway Timeout
Mechanism: The netloc includes authentication credentials, preventing proper proxy bypass checks
Why the fix works: Fixes the issue by passing only the hostname/IP to urllib's `proxy_bypass` function, which resolves the timeout problem caused by including authentication credentials in the netloc. (first fixed release: 2.27.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The netloc includes authentication credentials, preventing proper proxy bypass checks
Surfaces as: OSError: Tunnel connection failed: 504 Gateway Timeout

Proof / Evidence

GitHub issue: #4158
Fix PR: https://github.com/psf/requests/pull/4427
First fixed release: 2.27.0
Reproduced locally: No (not executed)
Last verified: 2026-02-07
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.65

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“Yup, this seems incorrect to me. I'd welcome a patch to resolve this problem.”

@Lukasa · 2017-06-14 · source

Failure Signature (Search String)

OSError: Tunnel connection failed: 504 Gateway Timeout

Error Message

Stack trace

error.txt

Error Message
-------------
OSError: Tunnel connection failed: 504 Gateway Timeout
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=8080): Max retries exceeded with url: / (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 504 Gateway Timeout',)))

Minimal Reproduction

repro.py

import requests
import os

os.environ['https_proxy'] = #insert your proxy here
os.environ['no_proxy'] = 'localhost,127.0.0.1'

requests.get('https://username:password@localhost:8080/')

What Broke

Requests fail with timeout errors when using authentication in URLs with proxy settings.

Why It Broke

The netloc includes authentication credentials, preventing proper proxy bypass checks

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install requests==2.27.0

When NOT to use: Do not use this fix if authentication credentials are required for proxy access.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Option C — Workaround Temporary workaround

proxies kwarg can be used to bypass this issue, e.g. by setting {'https': None}. Should be used with caution.

When NOT to use: Do not use this fix if authentication credentials are required for proxy access.

Use only if you cannot change versions today. Treat this as a stopgap and remove once upgraded.

Fix reference: https://github.com/psf/requests/pull/4427

First fixed release: 2.27.0

Last verified: 2026-02-07. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if authentication credentials are required for proxy access.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Track RSS + object counts after deployments; alert on monotonic growth and GC pressure.
Add a long-running test that repeats the failing call path and asserts stable memory.

Version Compatibility Table

Version	Status
2.27.0	Fixed

Related Issues

No related fixes found.

Cluster: requests:configuration-error Requests hub Requests best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

Requests Making requests to URLs with username and password does not respect no_proxy evironment (Fix)