← Home ← Codex ← DEBT ← Engine
Browse by Category
+ added · updated 7d
← Back to glossary

HTTP in Python — requests & httpx

Python Python 3.7+ Beginner
debt(d5/e1/b3/t5)
d5 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'specialist tool catches' (d5) — semgrep/ruff rules can flag requests.get() without timeout, but default linters won't catch missing raise_for_status() or Session reuse issues; many problems only surface in production under slow upstream conditions.

e1 Effort Remediation debt — work required to fix once spotted

Closest to 'one-line patch' (e1) — quick_fix is adding a timeout=N parameter or swapping requests.get for httpx.get; per-call fixes are trivial single-line edits.

b3 Burden Structural debt — long-term weight of choosing wrong

Closest to 'localised tax' (b3) — HTTP client choice applies to web/cli contexts and tends to be used across many call sites, but switching libraries (requests↔httpx) is mechanical since APIs are similar; doesn't shape system architecture.

t5 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'notable trap' (t5) — misconception that urllib≈requests and that requests has sensible defaults; the no-default-timeout behavior is a well-documented gotcha that devs typically learn only after a production hang.

About DEBT scoring →

Also Known As

requests library httpx Python HTTP urllib

TL;DR

requests is the standard sync HTTP library; httpx adds async support, HTTP/2, and a similar API — both far more ergonomic than urllib.

Explanation

requests: synchronous HTTP with a clean API — Session for connection pooling, automatic JSON encoding/decoding, timeout parameter (always set it), retry with HTTPAdapter. httpx: requests-compatible API plus async (async with httpx.AsyncClient()), HTTP/2 support, better streaming. Key practices: always set timeout, use sessions for multiple requests to the same host (connection reuse), check response.raise_for_status() rather than manual status code checking, and never disable SSL verification (verify=False is insecure).

Common Misconception

urllib is equivalent to requests — urllib requires manual encoding, header management, and error handling; requests provides a dramatically simpler API with the same power.

Why It Matters

HTTP without timeout is a reliability disaster — a single slow upstream server hangs the entire process indefinitely; always setting timeout is the difference between a resilient and a fragile service.

Common Mistakes

  • No timeout parameter — process hangs indefinitely on slow servers.
  • Not using Session for multiple requests — creates a new TCP connection per request.
  • verify=False to bypass SSL — disables certificate verification, enabling MITM.
  • Not calling raise_for_status() — 400/500 responses silently succeed without it.

Code Examples

✗ Vulnerable
import requests
# No timeout — hangs forever if server is slow:
response = requests.get('https://api.example.com/data')
# No error check — 500 treated as success:
data = response.json()

# New connection every request:
for url in urls:
    requests.get(url)  # New TCP connection each time
✓ Fixed
import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# Session with retry and timeout:
session = requests.Session()
retry = Retry(total=3, backoff_factor=0.3, status_forcelist=[500, 502, 503])
session.mount('https://', HTTPAdapter(max_retries=retry))

response = session.get('https://api.example.com/data', timeout=(3.05, 27))
response.raise_for_status()  # Raises for 4xx/5xx
data = response.json()

# Async with httpx:
async with httpx.AsyncClient(timeout=30) as client:
    response = await client.get(url)
    response.raise_for_status()

Added 16 Mar 2026
Edited 22 Mar 2026
Views 213
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 1 ping T 1 ping W 0 pings T 1 ping F 0 pings S 1 ping S 2 pings M 1 ping T 1 ping W 0 pings T 0 pings F 0 pings S 2 pings S 0 pings M 0 pings T 1 ping W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 1 ping T 2 pings W 0 pings T
No pings yet today
Amazonbot 1 Ahrefs 1
Perplexity 38 Amazonbot 28 ChatGPT 21 Google 11 Ahrefs 9 SEMrush 9 Claude 4 Unknown AI 3 Bing 3 Twitter/X 3 Qwen 2 Scrapy 2 Brave Search 2 Applebot 2 Baidu 2 Meta AI 1 Sogou 1
crawler 137 crawler_json 4
🧱 FUNDAMENTALS — new to this? Start with the ground floor.
Python general Python is a programming language known for readable syntax and versatility, used for web development, data science, automation, and more.

Python's gentle learning curve makes it an ideal first language, while its vast ecosystem keeps it relevant for machine learning, APIs, and DevOps. Skills transfer directly to professional environments because Python runs in production at companies of every size.

💡 When Python throws IndentationError, check that every block uses the same whitespace style—pick spaces (preferably 4) and stick with them everywhere.

Ask Codex about Python →
DEV INTEL Tools & Severity
🟡 Medium ⚙ Fix effort: Low
⚡ Quick Fix
Use httpx instead of requests for new Python code — it has the same API but supports async, HTTP/2, and proper timeout defaults; always set explicit timeouts on all HTTP calls
📦 Applies To
python 3.7 web cli
🔗 Prerequisites
🔍 Detection Hints
requests.get() without timeout parameter; no retry logic for transient failures; blocking HTTP call in async context
Auto-detectable: ✓ Yes pylint ruff semgrep
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: Low Context: Function Tests: Update
CWE-400


✓ schema.org compliant