Skip to content

gh-49288: Reset file-like POST body on HTTP auth retry - #153726

Open
orsenthil wants to merge 1 commit into
python:mainfrom
orsenthil:orsenthil/49288
Open

gh-49288: Reset file-like POST body on HTTP auth retry#153726
orsenthil wants to merge 1 commit into
python:mainfrom
orsenthil:orsenthil/49288

Conversation

@orsenthil

@orsenthil orsenthil commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Fix long-standing bug where HTTP Basic/Digest auth retries send an empty POST body when Request.data is a consumed file-like object (e.g. mmap.mmap, open file, BytesIO).

Fixes gh-49288.

@bedevere-app bedevere-app Bot mentioned this pull request Jul 15, 2026
Open
@read-the-docs-community

read-the-docs-community Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35380333 | 📁 Comparing 344f5cd against main (1b3914a)

  🔍 Preview build  

428 files changed · + 10 added · ± 418 modified

+ Added

± Modified

@simpleprogrammer2

simpleprogrammer2 commented Jul 22, 2026

Copy link
Copy Markdown

@gpshead could you please review this ( I am a new contributor, trying to find best ways to help) ?

@orsenthil

orsenthil commented Sep 11, 2026

Copy link
Copy Markdown
Member Author

@serhiy-storchaka , would you like to review this?

ambv
ambv requested changes Oct 23, 2026
View reviewed changes

@ambv ambv left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of wrapping req.data, can't we just record where the body starts and seek the original object back there before retrying? That solves the things I'm pointing out in the comments.

Comment thread Lib/urllib/request.py Outdated
Comment thread Lib/urllib/request.py Outdated
Comment thread Lib/urllib/request.py Outdated
@bedevere-app

bedevere-app Bot commented Oct 23, 2026

Copy link
Copy Markdown

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

@orsenthil

orsenthil commented Oct 24, 2026

Copy link
Copy Markdown
Member Author

Instead of wrapping req.data, can't we just record where the body starts and seek the original object back there before retrying?

Yup, sounds good.

For the non-seekable body, we will not do a retry. We can retry the 401, so that sender and send with the fresh stream.

@orsenthil
pythongh-49288: Resend POST body on HTTP auth retry
344f5cd 
Fix :mod:`urllib.request` HTTP authentication retries sending an empty
POST body when :attr:`~urllib.request.Request.data` is a file-like
object.  The body is now rewound to the position it was in before the
original request was sent; if it is not seekable, the retry is abandoned
and the ``401`` response is returned to the caller instead.
@orsenthil

orsenthil commented Oct 24, 2026

Copy link
Copy Markdown
Member Author

I have made the requested changes; please review again.

@bedevere-app

bedevere-app Bot commented Oct 24, 2026

Copy link
Copy Markdown

Thanks for making the requested changes!

@ambv: please review the changes made to this pull request.

@bedevere-app
bedevere-app Bot requested a review from ambv October 24, 2026 16:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka
@ambv ambv Awaiting requested review from ambv

Assignees

No one assigned

Labels

awaiting change review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

urrlib2/httplib doesn't reset file position between requests

3 participants

@orsenthil @simpleprogrammer2 @ambv