urllib3 Accessing HTTPS sites through proxy (Fix)

The Fix

pip install urllib3==1.25.11

Based on closed urllib3/urllib3 issue #1520 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -9,6 +9,7 @@
 from .packages.six.moves.http_client import HTTPConnection as _HTTPConnection
 from .packages.six.moves.http_client import HTTPException  # noqa: F401
+from .util.proxy import create_proxy_ssl_context
 
 try:  # Compiled with SSL?

repro.py

def request_url(self, request, proxies):
        """Obtain the url to use when making the final request.
        If the message is being sent through a HTTP proxy, the full URL has to
        be used. Otherwise, we should only use the path portion of the URL.
        This should not be called from user code, and is only exposed for use
        when subclassing the
        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`.
        :param request: The :class:`PreparedRequest <PreparedRequest>` being sent.
        :param proxies: A dictionary of schemes or schemes and hosts to proxy URLs.
        :rtype: str
        """
        proxy = select_proxy(request.url, proxies)
        scheme = urlparse(request.url).scheme

        is_proxied_http_request = (proxy and scheme != 'https')
        using_socks_proxy = False
        if proxy:
            proxy_scheme = urlparse(proxy).scheme.lower()
            using_socks_proxy = proxy_scheme.startswith('socks')

        url = request.path_url
        if is_proxied_http_request and not using_socks_proxy:
            url = urldefragauth(request.url)

        return url

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install urllib3==1.25.11\nWhen NOT to use: Do not use this fix if your application requires the previous behavior of forwarding absolute URIs through HTTPS proxies.\n\n

Why This Fix Works in Production

Trigger: Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.
Mechanism: urllib3's previous implementation did not support HTTPS proxies for HTTPS destinations due to limitations in the standard library
Why the fix works: Integrates TLS-in-TLS support into urllib3, enabling the use of HTTPS proxies with HTTPS destinations. (first fixed release: 1.25.11).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

urllib3's previous implementation did not support HTTPS proxies for HTTPS destinations due to limitations in the standard library
Production symptom (often without a traceback): Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.

Proof / Evidence

GitHub issue: #1520
Fix PR: https://github.com/urllib3/urllib3/pull/1923
First fixed release: 1.25.11
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.50

Verified Execution

We executed the runnable minimal repro in a temporary environment and captured exit codes + logs.

Status: PASS
Ran: 2026-02-11T16:52:29Z
Package: urllib3
Fixed: 1.25.11
Mode: fixed_only
Outcome: ok

Logs

affected (exit=None)

fixed (exit=0)

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“Is there a roadmap of what needs to be done to support HTTPS over proxy in urllib3? How much work is it? What has already…”

@glaukon-ariston · 2019-01-11 · source

“Closing this issue via https://github.com/urllib3/urllib3/pull/1923”

@sethmlarson · 2021-06-19 · confirmation · source

“@J3wker @glaukon-ariston Thanks to the work of @jalopezsilva, the next release will support HTTPS proxies fully, even offering TLS-in-TLS when both the proxy and the…”

@pquentin · 2020-10-19 · source

“It's a limitation of the fact that urllib3 uses httplib/http.request under the covers and the standard library is terrible at supporting this particular use-case. Luckily…”

@sigmavirus24 · 2019-01-11 · source

Failure Signature (Search String)

Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.

Copy-friendly signature

signature.txt

Failure Signature
-----------------
Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.

Minimal Reproduction

repro.py

def request_url(self, request, proxies):
        """Obtain the url to use when making the final request.
        If the message is being sent through a HTTP proxy, the full URL has to
        be used. Otherwise, we should only use the path portion of the URL.
        This should not be called from user code, and is only exposed for use
        when subclassing the
        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`.
        :param request: The :class:`PreparedRequest <PreparedRequest>` being sent.
        :param proxies: A dictionary of schemes or schemes and hosts to proxy URLs.
        :rtype: str
        """
        proxy = select_proxy(request.url, proxies)
        scheme = urlparse(request.url).scheme

        is_proxied_http_request = (proxy and scheme != 'https')
        using_socks_proxy = False
        if proxy:
            proxy_scheme = urlparse(proxy).scheme.lower()
            using_socks_proxy = proxy_scheme.startswith('socks')

        url = request.path_url
        if is_proxied_http_request and not using_socks_proxy:
            url = urldefragauth(request.url)

        return url

What Broke

Users were unable to access HTTPS sites through HTTPS proxies, leading to failed requests.

Why It Broke

urllib3's previous implementation did not support HTTPS proxies for HTTPS destinations due to limitations in the standard library

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.25.11

When NOT to use: Do not use this fix if your application requires the previous behavior of forwarding absolute URIs through HTTPS proxies.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/1923

First fixed release: 1.25.11

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if your application requires the previous behavior of forwarding absolute URIs through HTTPS proxies.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
1.25.11	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.