# Risk map — encode/httpx

> Canonical page: https://codevetter.com/unpack/httpx/risk-map

# Risk map — encode/httpx

Scanned commit b5addb64f0161ff6bfe94c124ef76f6a1fba5254 (2026-02-23). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The following are source observations and one explicitly labeled resource-risk hypothesis, not confirmed vulnerabilities. Sensitive boundaries include outbound routing, certificate trust, credentials, redirects, stream ownership, and filesystem downloads. Several restrictions are intentional compatibility or API limits with corresponding tests. Documentation drift and excluded branches also matter when an agent assesses behavior.
- Verbose CLI tracing prints raw request headers, including reversible Basic Authorization; help text warns about this and test_auth asserts the exposed header. Headers.__repr__ masking therefore does not imply CLI output redaction. — [httpx/_main.py#L116-L126](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_main.py#L116-L126) [httpx/_main.py#L235-L240](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_main.py#L235-L240) [httpx/_main.py#L385-L389](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_main.py#L385-L389) [tests/test_main.py#L145-L160](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/tests/test_main.py#L145-L160)
- trust_env defaults true; environment/system proxy discovery can alter routing, and SSL_CERT_FILE/SSL_CERT_DIR can replace default certificate locations. Custom transports disable automatic environment-proxy discovery, while explicit proxy configuration remains supported. — [httpx/_client.py#L639-L650](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_client.py#L639-L650) [httpx/_client.py#L685-L687](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_client.py#L685-L687) [httpx/_utils.py#L30-L76](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_utils.py#L30-L76) [httpx/_config.py#L33-L40](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_config.py#L33-L40)
- verify=False explicitly disables hostname checking and certificate verification. NetRCAuth loads a caller-selected or default netrc file at construction, and deprecated cert arguments load certificate chains from external paths. — [httpx/_config.py#L41-L44](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_config.py#L41-L44) [httpx/_config.py#L58-L67](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_config.py#L58-L67) [httpx/_auth.py#L145-L166](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_auth.py#L145-L166)
- Redirect authorization policy depends on scheme, host and effective port; Authorization survives only same-origin redirects or the defined same-host HTTP:80-to-HTTPS:443 upgrade exception. Redirect requests also discard the original Cookie header and rebuild cookies from the jar. — [httpx/_client.py#L62-L91](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_client.py#L62-L91) [httpx/_client.py#L546-L571](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_client.py#L546-L571) [tests/client/test_redirects.py#L266-L308](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/tests/client/test_redirects.py#L266-L308)
- Manual stream=True callers must arrange response closure, and generator request bodies can raise StreamConsumed when redirected or retried for Digest authentication; inspected tests encode both replay restrictions. — [docs/async.md#L87-L105](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/docs/async.md#L87-L105) [httpx/_content.py#L50-L64](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_content.py#L50-L64) [tests/client/test_redirects.py#L345-L361](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/tests/client/test_redirects.py#L345-L361) [tests/client/test_auth.py#L688-L707](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/tests/client/test_auth.py#L688-L707)
- Resource-risk hypothesis: large or highly compressed responses can demand substantial memory because read()/aread() join decoded bodies, ASGITransport collects response parts, and its stream joins them. Connection Limits do not impose a body-size bound in these inspected paths. (inferred) — [httpx/_models.py#L876-L905](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_models.py#L876-L905) [httpx/_models.py#L974-L980](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_models.py#L974-L980) [httpx/_transports/asgi.py#L55-L60](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_transports/asgi.py#L55-L60) [httpx/_transports/asgi.py#L158-L185](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_transports/asgi.py#L158-L185) [httpx/_config.py#L159-L182](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_config.py#L159-L182)
- Digest authentication retains challenge and nonce-counter state and deliberately rejects auth-int-only challenges with NotImplementedError; a test expects that failure, so auth-int must not be described as supported. — [httpx/_auth.py#L187-L222](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_auth.py#L187-L222) [httpx/_auth.py#L329-L340](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_auth.py#L329-L340) [tests/client/test_auth.py#L505-L512](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/tests/client/test_auth.py#L505-L512)
- The WSGITransport docstring still recommends Client(app=app), but the inspected Client constructor accepts transport and has no app argument. This concrete documentation drift makes constructor source a necessary check before copying examples. — [httpx/_transports/wsgi.py#L44-L64](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_transports/wsgi.py#L44-L64) [httpx/_client.py#L639-L662](https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_client.py#L639-L662)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)