Requests netrc reading does not respect NETRC environment

The Fix

pip install requests==2.27.0

Based on closed psf/requests issue #4318 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -213,7 +213,8 @@ Note: Custom headers are given less precedence than more specific sources of inf
 * Authorization headers set with `headers=` will be overridden if credentials
   are specified in ``.netrc``, which in turn will be overridden by the  ``auth=``
-  parameter.
+  parameter. Requests will search for the netrc file at `~/.netrc`, `~/_netrc`,
+  or at the path specified by the `NETRC` environment variable.

repro.py

{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.6"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.5.2"
  },
  "platform": {
    "release": "14.5.0",
    "system": "Darwin"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.18.4"
  },
  "system_ssl": {
    "version": "100020cf"
  },
  "urllib3": {
    "version": "1.22"
  },
  "using_pyopenssl": false
}

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install requests==2.27.0\nWhen NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.\n\n

Why This Fix Works in Production

Trigger: netrc reading does not respect NETRC environment variable
Mechanism: Implements support for the NETRC environment variable, allowing users to specify a custom location for their .netrc file.
Why the fix works: Implements support for the NETRC environment variable, allowing users to specify a custom location for their .netrc file. (first fixed release: 2.27.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

Production symptom (often without a traceback): netrc reading does not respect NETRC environment variable

Proof / Evidence

GitHub issue: #4318
Fix PR: https://github.com/psf/requests/pull/5643
Fix commit: https://github.com/psf/requests/commit/2f70990cd3fabf7b05cb9a69b3dab1a43bbf0096
First fixed release: 2.27.0
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.75
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.50

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“Do we still want this feature? I want this feature, but I don't know overall sentiment among users”

@chairmank · 2019-07-31 · source

“This has been open very long without response. How will this case be handled? This would be a very good feature to implement.”

@nik003 · 2020-04-16 · source

“This project has generally had a terrible experience with it's netrc support”

@sigmavirus24 · 2020-04-17 · source

Failure Signature (Search String)

netrc reading does not respect NETRC environment variable
"pyOpenSSL": {

Copy-friendly signature

signature.txt

Failure Signature
-----------------
netrc reading does not respect NETRC environment variable
"pyOpenSSL": {

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
netrc reading does not respect NETRC environment variable
"pyOpenSSL": {

Minimal Reproduction

repro.py

{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.6"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.5.2"
  },
  "platform": {
    "release": "14.5.0",
    "system": "Darwin"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.18.4"
  },
  "system_ssl": {
    "version": "100020cf"
  },
  "urllib3": {
    "version": "1.22"
  },
  "using_pyopenssl": false
}

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install requests==2.27.0

When NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/psf/requests/pull/5643

First fixed release: 2.27.0

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use if it changes public behavior or if the failure cannot be reproduced.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
2.27.0	Fixed

Related Issues

No related fixes found.

Cluster: requests:configuration-error Requests hub Requests best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

Requests netrc reading does not respect NETRC environment variable (Fix)