urllib3 App Engine Error with HTTPS (Fix)

The Fix

pip install urllib3==1.25

Based on closed urllib3/urllib3 issue #1503 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -171,7 +171,8 @@ def _new_conn(self):
     def _prepare_conn(self, conn):
         self.sock = conn
-        if self._tunnel_host:
+        # Google App Engine's httplib does not define _tunnel_host
+        if getattr(self, '_tunnel_host', None):

repro.py

Traceback (most recent call last):
  ...
  File "/project/updater/search_backend.py", line 1353, in setup
    "/_alias/%s"%self.index_name)
  File "/project/libs/elasticsearch_five/transport.py", line 312, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/project/libs/elasticsearch_five/connection/http_urllib3.py", line 114, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/project/libs/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/project/libs/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/project/libs/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/project/libs/urllib3/connection.py", line 304, in connect
    if self._tunnel_host:
AttributeError: 'VerifiedHTTPSConnection' object has no attribute '_tunnel_host'

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: Do not use this fix if your environment correctly implements '_tunnel_host'.\n\n

Why This Fix Works in Production

Mechanism: The absence of the '_tunnel_host' attribute in Google App Engine's httplib implementation caused an AttributeError
Why the fix works: Fixes an issue with Google App Engine's httplib implementation by adding a check for _tunnel_host. (first fixed release: 1.25).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

The absence of the '_tunnel_host' attribute in Google App Engine's httplib implementation caused an AttributeError
Surfaces as: Traceback (most recent call last):

Proof / Evidence

GitHub issue: #1503
Fix PR: https://github.com/urllib3/urllib3/pull/1527
First fixed release: 1.25
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.35

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“I believe the change in PR #1430 broke urllib3 on Google App Engine, which doesn't have _tunnel_host in its implementation of httplib. Not sure why this wasn't picked up by tests, but the fix is easy, simply adding if getattr(self, '_tunnel”

Issue thread · issue description · source

Error Message

Stack trace

error.txt

Error Message
-------------
Traceback (most recent call last):
  ...
  File "/project/updater/search_backend.py", line 1353, in setup
    "/_alias/%s"%self.index_name)
  File "/project/libs/elasticsearch_five/transport.py", line 312, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/project/libs/elasticsearch_five/connection/http_urllib3.py", line 114, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/project/libs/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/project/libs/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/project/libs/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/project/libs/urllib3/connection.py", line 304, in connect
    if self._tunnel_host:
AttributeError: 'VerifiedHTTPSConnection' object has no attribute '_tunnel_host'

Minimal Reproduction

repro.py

Traceback (most recent call last):
  ...
  File "/project/updater/search_backend.py", line 1353, in setup
    "/_alias/%s"%self.index_name)
  File "/project/libs/elasticsearch_five/transport.py", line 312, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/project/libs/elasticsearch_five/connection/http_urllib3.py", line 114, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/project/libs/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/project/libs/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/project/libs/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/project/libs/urllib3/connection.py", line 304, in connect
    if self._tunnel_host:
AttributeError: 'VerifiedHTTPSConnection' object has no attribute '_tunnel_host'

What Broke

Users experienced AttributeError when making HTTPS requests on Google App Engine.

Why It Broke

The absence of the '_tunnel_host' attribute in Google App Engine's httplib implementation caused an AttributeError

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.25

When NOT to use: Do not use this fix if your environment correctly implements '_tunnel_host'.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/1527

First fixed release: 1.25

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if your environment correctly implements '_tunnel_host'.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Track RSS + object counts after deployments; alert on monotonic growth and GC pressure.
Add a long-running test that repeats the failing call path and asserts stable memory.

Version Compatibility Table

Version	Status
1.25	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.