boring-http 2.0.2__tar.gz → 2.1.0__tar.gz

boring_http-2.0.2/README.md → boring_http-2.1.0/PKG-INFO

@@ -1,3 +1,13 @@
+Metadata-Version: 2.3
+Name: boring-http
+Version: 2.1.0
+Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
+Requires-Dist: boring-ssl2>=1.2.0
+Requires-Dist: ssl2>=2.0.1
+Requires-Python: >=3.14
+Project-URL: Repository, https://github.com/baobien-dev/boring-http
+Description-Content-Type: text/markdown
+
 # boring-http
 
 An asyncio HTTP client on BoringSSL through `ssl2` and `boring-ssl2`. HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers sent in the order you give them, cookies, redirects, phased timeouts, gzip, deflate, brotli and zstd decoding. Runs on asyncio and on uvloop. Requires Python 3.14.
@@ -60,7 +70,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 
@@ -90,6 +100,8 @@ asyncio.run(main())
 
 A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
+A body is held to what the application reads: over HTTP/2 and HTTP/3 the stream window opens again only as chunks are taken, so a response nobody reads stops at one window (`INITIAL_WINDOW_SIZE` or `initial_max_stream_data_bidi_local`), while the connection window keeps opening on arrival so other streams go on. An HTTP/3 upload keeps at most 1 MiB of the body unsent before it asks the body for the next chunk; HTTP/1.1 and HTTP/2 uploads wait on the socket and the peer's window.
+
 ## HTTP/3
 
 ```python

boring_http-2.0.2/PKG-INFO → boring_http-2.1.0/README.md

@@ -1,13 +1,3 @@
-Metadata-Version: 2.3
-Name: boring-http
-Version: 2.0.2
-Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
-Requires-Dist: boring-ssl2>=1.2.0
-Requires-Dist: ssl2>=2.0.1
-Requires-Python: >=3.14
-Project-URL: Repository, https://github.com/baobien-dev/boring-http
-Description-Content-Type: text/markdown
-
 # boring-http
 
 An asyncio HTTP client on BoringSSL through `ssl2` and `boring-ssl2`. HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers sent in the order you give them, cookies, redirects, phased timeouts, gzip, deflate, brotli and zstd decoding. Runs on asyncio and on uvloop. Requires Python 3.14.
@@ -70,7 +60,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 
@@ -100,6 +90,8 @@ asyncio.run(main())
 
 A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
+A body is held to what the application reads: over HTTP/2 and HTTP/3 the stream window opens again only as chunks are taken, so a response nobody reads stops at one window (`INITIAL_WINDOW_SIZE` or `initial_max_stream_data_bidi_local`), while the connection window keeps opening on arrival so other streams go on. An HTTP/3 upload keeps at most 1 MiB of the body unsent before it asks the body for the next chunk; HTTP/1.1 and HTTP/2 uploads wait on the socket and the peer's window.
+
 ## HTTP/3
 
 ```python

{boring_http-2.0.2 → boring_http-2.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.2"
+version = "2.1.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.2 → boring_http-2.1.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.2"
+version = "2.1.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.2 → boring_http-2.1.0}/src/boring_http/cookies.py

@@ -4,6 +4,16 @@ from dataclasses import dataclass
 from email.utils import parsedate_to_datetime
 from typing import Self
 
+from boring_http.public_suffixes import EXCEPTIONS, RULES
+
+
+def is_public_suffix(domain: str) -> bool:
+    # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
+    if domain in EXCEPTIONS:
+        return False
+    parent = domain.partition(".")[2]
+    return domain in RULES or f"*.{parent}" in RULES or not parent
+
 
 @dataclass(frozen=True, slots=True)
 class Cookie:
@@ -46,6 +56,11 @@ class Cookie:
                     pass
         if domain and not (host == domain or host.endswith("." + domain)):
             return None
+        # RFC 6265 section 5.3 step 5: a public suffix as Domain is refused, unless it is the host itself, which keeps the cookie to that host
+        if domain and is_public_suffix(domain):
+            if domain != host:
+                return None
+            domain = ""
         if not path.startswith("/"):
             path = request_path[: request_path.rfind("/")] or "/"
         return cls(

{boring_http-2.0.2 → boring_http-2.1.0}/src/boring_http/http2.py

@@ -105,7 +105,8 @@ class Http2Stream:
         self.waiter: asyncio.Future[None] | None = None
         self.trailers = Headers()
         self.block = bytearray()
-        self.received = 0
+        # what the application took since the last WINDOW_UPDATE for this stream
+        self.consumed = 0
         self.finished = False
 
     def fail(self, error: BaseException) -> None:
@@ -382,7 +383,9 @@ class Http2Connection:
         try:
             while True:
                 if stream.chunks:
-                    yield stream.take()
+                    data = stream.take()
+                    await self.credit(stream, len(data))
+                    yield data
                 elif stream.error is not None:
                     raise stream.error
                 elif stream.finished:
@@ -409,6 +412,24 @@ class Http2Connection:
                 )
             )
 
+    async def credit(self, stream: Http2Stream, size: int) -> None:
+        # the stream window opens again as the application takes data, so a reader that stops holds the server at one window
+        stream.consumed += size
+        if (
+            stream.consumed > self._local_window // 2
+            and not stream.finished
+            and not self.closed
+        ):
+            increment, stream.consumed = stream.consumed, 0
+            await self._write(
+                self._frame(
+                    FrameType.WINDOW_UPDATE,
+                    0,
+                    stream.identifier,
+                    struct.pack("!I", increment),
+                )
+            )
+
     async def _write(self, data: bytes) -> None:
         async with self._write_lock:
             await self._transport.write(data)
@@ -512,15 +533,7 @@ class Http2Connection:
             if flags & END_STREAM:
                 stream.finished = True
             stream.wake()
-            stream.received += len(payload)
-            if stream.received > self._local_window // 2 and not stream.finished:
-                updates = self._frame(
-                    FrameType.WINDOW_UPDATE,
-                    0,
-                    identifier,
-                    struct.pack("!I", stream.received),
-                )
-                stream.received = 0
+        # the connection window opens on arrival, so one stream that is not read leaves the others their share
         self._connection_received += len(payload)
         if self._connection_received > self._connection_window // 2:
             updates += self._frame(
@@ -657,6 +670,7 @@ class Http2StreamTransport:
         while not self._pending:
             if stream.chunks:
                 self._pending = stream.take()
+                await self._connection.credit(stream, len(self._pending))
             elif stream.error is not None:
                 raise stream.error
             elif stream.finished:

{boring_http-2.0.2 → boring_http-2.1.0}/src/boring_http/http3.py

@@ -94,6 +94,8 @@ class Http3Settings:
 
 # RFC 8470 section 5.2: the requests a client may send before the handshake, since a server may see them twice
 SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+# how much of a body may wait unsent in its QUIC stream before the next chunk is taken from the caller
+SEND_BUFFER = 1 << 20
 
 
 class StreamFrames:
@@ -266,6 +268,7 @@ class Http3Connection:
             async with deadline.phase("write"):
                 async for chunk in request.body.chunks():
                     self._quic.send(stream_id, self._frame(FrameType.DATA, chunk))
+                    await self._quic.drain(stream_id, SEND_BUFFER)
                 self._quic.send(stream_id, b"", end=True)
         frames = StreamFrames(self._quic, stream_id, deadline)
         status, headers = await self._response_head(frames, stream_id)
@@ -554,6 +557,8 @@ class Http3StreamTransport:
             + Writer.encode_varint(len(data))
             + data,
         )
+        async with self._deadline.phase("write"):
+            await self._quic.drain(self._stream_id, SEND_BUFFER)
 
     async def close(self) -> None:
         if not self._closed: