cexy 0.1.0.dev2__tar.gz → 0.1.0.dev3__tar.gz

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/CHANGELOG.md

@@ -3,7 +3,18 @@
 All notable changes to this project are documented here. The SDK stays at 0.x until API
 request signing (HMAC) ships; see "Versioning" in README.md.
 
-## 0.1.0.dev2 (unreleased)
+## 0.1.0.dev3 (unreleased)
+
+### Security
+- **Redirects are never followed**, including on a caller-supplied `http_client` created with
+  `follow_redirects=True`. Earlier versions set `follow_redirects=False` only on the client they
+  created themselves, so a caller's following client re-sent `X-API-Key` and `X-API-Secret` to a
+  redirect target (httpx strips only `Authorization`), and a 307/308 re-posted an order. A 3xx
+  was also treated as success. Every request now passes `follow_redirects=False`, and a 3xx
+  raises `CexyApiError` with code `UNEXPECTED_REDIRECT`, which is not retried. Upgrade from
+  0.1.0.dev2 or earlier if you pass your own `http_client`.
+
+## 0.1.0.dev2 (2026-09-27)
 
 - `JurisdictionBlockedError` (a `ForbiddenError` subclass) for `JURISDICTION_BLOCKED` / HTTP 451.
 - README: pre-releases install with `pip install --pre cexy` (the PyPI page for 0.1.0.dev1 still says `pip install cexy`, which does not install a pre-release).

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cexy
-Version: 0.1.0.dev2
+Version: 0.1.0.dev3
 Summary: Python SDK for the CEXY.io exchange REST and WebSocket API
 Project-URL: Homepage, https://cexy.io
 Project-URL: Source, https://github.com/cexyio/cexy-python
@@ -44,7 +44,7 @@ Typed Python client for the [CEXY.io](https://cexy.io) exchange REST and WebSock
 - Client-side rate limiting, cursor pagination
 - WebSocket client with heartbeat, reconnect and a self-syncing order book
 
-> Status: **0.1.0.dev2, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Status: **0.1.0.dev3, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
 > Pre-releases need `--pre`: `pip install --pre cexy`.
 
 ## Install
@@ -285,6 +285,9 @@ client emits `auth_lost`; the socket stays open for public channels.
 - The SDK redacts keys from `repr()`, logs and exception messages, and never sends an
   `Authorization` header. If a server response echoes the key or secret, it is replaced
   with `***` in the exception's message, details, fields and request id.
+- The SDK **never follows HTTP redirects**, even on an `http_client` you created with
+  `follow_redirects=True`. A 3xx answer raises `CexyApiError` with code `UNEXPECTED_REDIRECT`
+  (not retried), so keys are never re-sent to another host and an order is never re-posted.
 - Connections use `https://` and `wss://` only. `allow_insecure=True` permits `http://` or
   `ws://` for a loopback host (localhost, 127.0.0.1, ::1) only, for local testing.
 - Report vulnerabilities as described in [SECURITY.md](SECURITY.md).

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/README.md

@@ -8,7 +8,7 @@ Typed Python client for the [CEXY.io](https://cexy.io) exchange REST and WebSock
 - Client-side rate limiting, cursor pagination
 - WebSocket client with heartbeat, reconnect and a self-syncing order book
 
-> Status: **0.1.0.dev2, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Status: **0.1.0.dev3, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
 > Pre-releases need `--pre`: `pip install --pre cexy`.
 
 ## Install
@@ -249,6 +249,9 @@ client emits `auth_lost`; the socket stays open for public channels.
 - The SDK redacts keys from `repr()`, logs and exception messages, and never sends an
   `Authorization` header. If a server response echoes the key or secret, it is replaced
   with `***` in the exception's message, details, fields and request id.
+- The SDK **never follows HTTP redirects**, even on an `http_client` you created with
+  `follow_redirects=True`. A 3xx answer raises `CexyApiError` with code `UNEXPECTED_REDIRECT`
+  (not retried), so keys are never re-sent to another host and an order is never re-posted.
 - Connections use `https://` and `wss://` only. `allow_insecure=True` permits `http://` or
   `ws://` for a loopback host (localhost, 127.0.0.1, ::1) only, for local testing.
 - Report vulnerabilities as described in [SECURITY.md](SECURITY.md).

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/cexy/_async/transport.py

@@ -114,7 +114,12 @@ class AsyncTransport:
             if op.auth == "api_key" and self.auth is not None:
                 self.auth.apply(op.method, url, send_headers, content)
             try:
-                resp = await self.http.request(op.method, url, params=params, content=content, headers=send_headers)
+                # Never follow redirects, even on a caller-supplied client created with
+                # follow_redirects=True: httpx would re-send X-API-Key/X-API-Secret to the target
+                # (it strips only Authorization), and a 307/308 would re-POST an order.
+                resp = await self.http.request(
+                    op.method, url, params=params, content=content, headers=send_headers, follow_redirects=False
+                )
             except httpx.TransportError as exc:
                 ambiguous = not isinstance(exc, _NOT_SENT)
                 reason = redact_text(f"{type(exc).__name__}: {exc}", self._secrets())
@@ -132,6 +137,14 @@ class AsyncTransport:
             resp_headers = lower_headers(resp.headers)
             self.limiter.update_from_headers(resp_headers)
             logger.debug("cexy: %s %s -> %d (attempt %d)", op.method, op.path, resp.status_code, attempt)
+            if 300 <= resp.status_code < 400:
+                raise CexyApiError(
+                    "UNEXPECTED_REDIRECT",
+                    f"{op.method} {op.path}: the server answered with a redirect (HTTP {resp.status_code}); "
+                    "the SDK does not follow redirects. Check base_url.",
+                    status=resp.status_code,
+                    retryable=False,
+                )
             if resp.status_code < 400:
                 if raw:
                     return resp.content

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/cexy/_sync/transport.py

@@ -116,7 +116,12 @@ class SyncTransport:
             if op.auth == "api_key" and self.auth is not None:
                 self.auth.apply(op.method, url, send_headers, content)
             try:
-                resp = self.http.request(op.method, url, params=params, content=content, headers=send_headers)
+                # Never follow redirects, even on a caller-supplied client created with
+                # follow_redirects=True: httpx would re-send X-API-Key/X-API-Secret to the target
+                # (it strips only Authorization), and a 307/308 would re-POST an order.
+                resp = self.http.request(
+                    op.method, url, params=params, content=content, headers=send_headers, follow_redirects=False
+                )
             except httpx.TransportError as exc:
                 ambiguous = not isinstance(exc, _NOT_SENT)
                 reason = redact_text(f"{type(exc).__name__}: {exc}", self._secrets())
@@ -134,6 +139,14 @@ class SyncTransport:
             resp_headers = lower_headers(resp.headers)
             self.limiter.update_from_headers(resp_headers)
             logger.debug("cexy: %s %s -> %d (attempt %d)", op.method, op.path, resp.status_code, attempt)
+            if 300 <= resp.status_code < 400:
+                raise CexyApiError(
+                    "UNEXPECTED_REDIRECT",
+                    f"{op.method} {op.path}: the server answered with a redirect (HTTP {resp.status_code}); "
+                    "the SDK does not follow redirects. Check base_url.",
+                    status=resp.status_code,
+                    retryable=False,
+                )
             if resp.status_code < 400:
                 if raw:
                     return resp.content

cexy-0.1.0.dev3/cexy/_version.py

@@ -0,0 +1 @@
+__version__ = "0.1.0.dev3"

{cexy-0.1.0.dev2 → cexy-0.1.0.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cexy"
-version = "0.1.0.dev2"
+version = "0.1.0.dev3"
 description = "Python SDK for the CEXY.io exchange REST and WebSocket API"
 readme = "README.md"
 license = "MIT"

cexy-0.1.0.dev2/cexy/_version.py

@@ -1 +0,0 @@
-__version__ = "0.1.0.dev2"