gh-155694: Scope HTTPPasswordMgr credentials by URL scheme by lkk7 · Pull Request #155696 · python/cpython

lkk7 · 2026-08-13T11:13:35Z

Scope HTTPPasswordMgr credentials by URL scheme. This prevents a situation where credentials stored for an HTTPS URL match a corresponding HTTP URL. URIs without a scheme will still match any scheme.

Issue: HTTPPasswordMgr can send saved HTTPS credentials via HTTP because of incorrect scheme matching #155694

read-the-docs-community · 2026-08-13T11:17:56Z

Documentation build overview

📚 cpython-previews | 🛠️ Build #34083435 | 📁 Comparing 5584ab9 against main (1c9521f)

🔍 Preview build

15 files changed · ± 15 modified

± Modified

Eclips4

Thank you!

miss-islington-app · 2026-08-17T19:39:20Z

Thanks @lkk7 for the PR, and @Eclips4 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

bedevere-app · 2026-08-17T19:39:35Z

GH-155968 is a backport of this pull request to the 3.15 branch.

bedevere-app · 2026-08-17T19:39:40Z

GH-155969 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-08-17T19:39:43Z

GH-155970 is a backport of this pull request to the 3.13 branch.

bedevere-app · 2026-08-17T19:39:48Z

GH-155971 is a backport of this pull request to the 3.12 branch.

bedevere-app · 2026-08-17T19:39:54Z

GH-155972 is a backport of this pull request to the 3.11 branch.

bedevere-app · 2026-08-17T19:39:58Z

GH-155973 is a backport of this pull request to the 3.10 branch.

…hon#155696) Credentials stored for an https:// URI were also matched against the corresponding http:// URI, since `reduce_uri()` discards the scheme. `HTTPPasswordMgr` and `HTTPPasswordMgrWithPriorAuth` now compare the scheme too; URIs registered without a scheme still match any scheme.

…-155696) (#155969) gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696) Credentials stored for an https:// URI were also matched against the corresponding http:// URI, since `reduce_uri()` discards the scheme. `HTTPPasswordMgr` and `HTTPPasswordMgrWithPriorAuth` now compare the scheme too; URIs registered without a scheme still match any scheme. (cherry picked from commit a7bb524) Co-authored-by: Łukasz <lukaszlapinski7@gmail.com>

…-155696) (#155970) gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696) Credentials stored for an https:// URI were also matched against the corresponding http:// URI, since `reduce_uri()` discards the scheme. `HTTPPasswordMgr` and `HTTPPasswordMgrWithPriorAuth` now compare the scheme too; URIs registered without a scheme still match any scheme. (cherry picked from commit a7bb524) Co-authored-by: Łukasz <lukaszlapinski7@gmail.com>

bedevere-bot · 2026-08-18T07:46:35Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x Fedora Stable Clang Installed 3.14 (tier-3) has failed when building commit a0d023f.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1693/builds/1286) and take a look at the build logs.
Check if the failure is related to this commit (a0d023f) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1693/builds/1286

Summary of the results of the build (if available):

Click to see traceback logs

Note: switching to 'a0d023fbd23773e24b35d8368789470e22cda5d8'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at a0d023fbd2377 [3.14] gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696) (#155969)
Switched to and reset branch '3.14'

configure: WARNING: s390x-ibm-linux-gnu/clang is not supported
configure: WARNING:

Platform "s390x-ibm-linux-gnu" with compiler "clang" is not supported by the
CPython core team, see https://peps.python.org/pep-0011/ for more information.


Objects/unicodeobject.c:5081:1: warning: unused function 'ctz' [-Wunused-function]
 5081 | ctz(size_t v)
      | ^~~
1 warning generated.
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:285:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  285 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:292:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  292 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:438:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  438 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:445:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  445 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:551:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  551 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:560:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  560 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:582:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  582 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:593:9: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  593 |         CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |         ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:690:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  690 |           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:735:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  735 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:761:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  761 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:772:9: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  772 |         CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |         ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:785:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  785 |           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:930:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  930 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:943:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  943 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:960:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  960 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:118:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  118 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:967:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  967 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:1202:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
 1202 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:312:
./Modules/expat/xmltok_impl.c:1222:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
 1222 |           CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:89:5: note: expanded from macro 'CHECK_NAME_CASES'
   89 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:47:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   47 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
19 warnings generated.
/usr/bin/ld.bfd: final link failed: No space left on device
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile:1846: _bootstrap_python] Error 1

chmod: cannot access 'target/': No such file or directory

pythongh-155694: Scope HTTPPasswordMgr credentials by URL scheme

b18449c

bedevere-app Bot mentioned this pull request Aug 13, 2026

HTTPPasswordMgr can send saved HTTPS credentials via HTTP because of incorrect scheme matching #155694

Open

bedevere-app Bot added the awaiting review label Aug 13, 2026

StanFromIreland requested a review from Eclips4 August 13, 2026 11:21

Eclips4 approved these changes Aug 14, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels Aug 14, 2026

Merge branch 'main' into fix-http-password-mgr-scheme

6e8cfe6

sethmlarson reviewed Aug 14, 2026

View reviewed changes

Comment thread Lib/urllib/request.py

Clarify documentation (schemeless password matching)

5584ab9

sethmlarson approved these changes Aug 17, 2026

View reviewed changes

Eclips4 merged commit a7bb524 into python:main Aug 17, 2026
63 checks passed

bedevere-app Bot removed the awaiting merge label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Aug 17, 2026

bedevere-app Bot removed the needs backport to 3.10 only security fixes label Aug 17, 2026

Navigation Menu

Uh oh!

Uh oh!

gh-155694: Scope HTTPPasswordMgr credentials by URL scheme - #155696

gh-155694: Scope HTTPPasswordMgr credentials by URL scheme#155696
Eclips4 merged 3 commits into
python:mainfrom
lkk7:fix-http-password-mgr-scheme

lkk7 commented Aug 13, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

read-the-docs-community Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

Eclips4 left a comment

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

lkk7 commented Aug 13, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Eclips4 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-app Bot commented Aug 17, 2026

Uh oh!

bedevere-bot commented Aug 18, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lkk7 commented Aug 13, 2026 •

edited by bedevere-app Bot

Loading

read-the-docs-community Bot commented Aug 13, 2026 •

edited

Loading