Shouldn't auth_flow have access to the client?

[ionelmc]

I'm a bit puzzled as to why auth_flow doesn't use prepared requests (requests merged with the stuff from the client).

Currently I'm holding a ref to the client in my auth class so I can use client.build_request but maybe there should be an easier way, either:

• make httpx call build_request or whatever is necessary to merge the request (some opt-in flag somewhere may be necessary for this behavior)
• make auth_flow take a the client as an argument (pretty sure this is breaking backwards compat, but maybe there could be a "auth_flow_with_client" or something nicer?)

[tomchristie]

what's a prepared request (in the context of httpx)?
what are you missing from the request instance that you're able to populate if you have a reference to the client?

[ionelmc]

I suppose the same problem is extended to headers and params. Not sure about cookies. Am I missing something here?

[tomchristie]

Well, consider this example:

client = httpx.Client(base_url='http://example.com')

If I don't use client.build_request I won't get the nice url merging.

Is that correct? build_request occurs before the auth flow...

httpx/httpx/_client.py

Lines 801 to 814 in df5dbc0

	request = self.build_request(
	method=method,
	url=url,
	content=content,
	data=data,
	files=files,
	json=json,
	params=params,
	headers=headers,
	cookies=cookies,
	timeout=timeout,
	extensions=extensions,
	)
	return self.send(request, auth=auth, follow_redirects=follow_redirects)

[ionelmc]

Yes it does but it doesn't occur for additional new requests you yield from auth_flow.

Maybe I should have posted this illustrative example xD

import logging
import httpx

logging.basicConfig(level=logging.DEBUG)

class MyAuth(httpx.Auth):
    def auth_flow(self, request: httpx.Request):
        resp = yield client.build_request('GET', 'get', params={'foo': 'bar'})
        # this should work the same, but it doesn't, instead it complains about
        # "missing http[s]://" cause the url wasn't merged with client base_url
        # resp = yield httpx.Request('GET', 'get')
        resp.read()
        request.headers['my-auth']= resp.json()['args']['foo']
        yield request


with httpx.Client(base_url='https://postman-echo.com', auth=MyAuth()) as client:
    resp = client.get('get')
    assert resp.json()['headers']['my-auth'] == 'bar'

[ionelmc]

Does this make sense? Is there a better way? Am I abusing the base_url feature?

[KalleDK]

I run into this again and again also, but for two reasons.

1. The base_url that @ionelmc talks about, this is often when I need to get a token from the base_url server. This i often "fix" by passing the base_url to the Auth object, this is "error-prone" imho

2. Anytime I have something with initial basic auth and then cookie auth with timeout. This problem I hit when I create async client, then multiple requests can be called and the cookie might be invalid. The naive way is just to let all the request relogin and let the last cookie win. This is not a great way of doing it. My solution so far i to have a lock in the auth that they have to wait for if the cookie is bad. Then reverify the cookie and if it is now valid use that - which is a pain to update a single cookie value in a prepared request. Or if it's stil invalid send a basic auth request and save that cookie in the Auth object (and the client automatic). But it's kinda a mess.

None of the two requires access to the client, but some kind of access to the data in the client like build_request and the cookies would do a lot.

[ionelmc]

So basically my complaint is that my auth class needs to have a reference to the client.

[rafalkrupinski]

Can't have a reference to Client, your auth flow might be called from AsyncClient...
Can't call response.read() either, for the same reason. The main httpx.Auth does it for you when you set self.requires_response_body = True.

But a bound build_request would be nice.