Registry / http-networking / requests-hardened

requests-hardened

library1.2.2pypypi✓ verified 82d ago

A security-hardened wrapper around the Python requests library that overrides default behaviors to prevent SSRF attacks, enforce TLS best practices, restrict IP ranges, and add safety features. Current version 1.2.2, supports Python >=3.10, <4.0, and is maintained actively by Saleor.

http-networking auth-security

pip install requests-hardened

github ↗package ↗changelog ↗

INSTALL

IMPORT

SIG · REQUESTS-HARDENED

requests-hardened

http-networkingpythonv1.2.2

Install

2.1s avg

Import

—

Disk

19MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.2.2 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 21MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.1s · import 0.000s · 21MB

19MB installed

● package 19MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

HTTPSession

✓ from requests_hardened import HTTPSession

✗ from requests_hardened import Session

Config

✓ from requests_hardened import Config

Manager

✓ from requests_hardened import Manager

Create a hardened requests Session with a Config object to enforce TLS and IP restrictions.

from requests_hardened import Session, Config config = Config( user_agent='MyApp/1.0', ip_filter_enabled=True, ip_filter_allow_loopback=True, force_tls_1_3=True ) session = Session(config=config) response = session.get('https://example.com') print(response.status_code)

Debug

Known issues

breakingVersion 1.2.1 fixed CVE-2026-42175 (SSRF bypass via shared address space 100.64.0.0/10). Users on <1.2.1 are vulnerable and must upgrade.

fix

pip install 'requests-hardened>=1.2.1'

affects: <1.2.1

deprecatedPython 3.9 support dropped in v1.2.0. Python 3.10+ required.

fix

Use Python 3.10 or newer, or pin to <1.2.0 if stuck on 3.9.

affects: >=1.2.0

gotchaThe library monkey-patches the global requests module when imported. This may break other code that expects the standard requests behavior.

fix

Use the provided Session class instead of relying on monkey-patched functions. Avoid mixing with other requests wrappers.

affects: all

Upgrade

Version history

1.2.2latest on PyPI · released Apr 28, 2026

Audit

Dependencies

requestsrequiredCore library that is overridden and patched.

Agent activity

30 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/saleor/requests-hardened ↗

packagehttps://pypi.org/project/requests-hardened/ ↗

changeloghttps://github.com/saleor/requests-hardened/releases/ ↗