foghttp 0.3.7__tar.gz → 0.3.9__tar.gz

{foghttp-0.3.7 → foghttp-0.3.9}/Cargo.lock

@@ -81,6 +81,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -92,6 +98,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -110,17 +122,21 @@ dependencies = [
 
 [[package]]
 name = "foghttp"
-version = "0.3.7"
+version = "0.3.9"
 dependencies = [
  "brotli",
  "bytes",
+ "fastrand",
  "flate2",
  "http-body-util",
+ "httpdate",
  "hyper",
  "hyper-rustls",
  "hyper-util",
  "pyo3",
+ "rfc_6265",
  "rustls",
+ "time",
  "tokio",
  "tower-service",
  "url",
@@ -224,6 +240,12 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -421,6 +443,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -454,6 +482,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -529,6 +563,16 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rfc_6265"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c385d4fba1a27dee6cdda85c619e8f714131a1c36da3ee4b67230414c8d7fd84"
+dependencies = [
+ "idna",
+ "time",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -674,6 +718,36 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
+[[package]]
+name = "time"
+version = "0.3.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.3"

{foghttp-0.3.7 → foghttp-0.3.9}/Cargo.toml

@@ -1,8 +1,9 @@
 [package]
 name = "foghttp"
-version = "0.3.7"
+version = "0.3.9"
 description = "Observable Rust-powered HTTP client for Python services."
 edition = "2021"
+rust-version = "1.88"
 homepage = "https://github.com/AmberFog/foghttp"
 license = "MIT"
 publish = false
@@ -20,8 +21,12 @@ extension-module = ["pyo3/extension-module"]
 [dependencies]
 brotli = "8.0.4"
 bytes = "1.12.0"
+fastrand = "2.3.0"
 flate2 = "1.1.9"
 http-body-util = "0.1.3"
+httpdate = "1.0.3"
+rfc_6265 = { version = "0.1.1", default-features = false, features = ["date", "idna", "path"] }
+time = { version = "0.3.54", default-features = false, features = ["std"] }
 url = "2.5.8"
 
 [dependencies.hyper]

{foghttp-0.3.7 → foghttp-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: foghttp
-Version: 0.3.7
+Version: 0.3.9
 Classifier: Development Status :: 3 - Alpha
 Classifier: Framework :: AsyncIO
 Classifier: License :: OSI Approved :: MIT License
@@ -74,6 +74,8 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 - typed telemetry event hooks with redacted request/response lifecycle events
 - versioned telemetry snapshots that separate alert-oriented stats from
   diagnostic dump APIs
+- opt-in Rust-owned retries with replayability gates and immutable attempt
+  traces, plus opt-in per-hop and post-DNS SSRF destination controls
 - opt-in async lifecycle debug snapshots for staging and tests
 - lazy process-wide shared Tokio runtime by default, opt-in dedicated runtime
   tuning, and fail-closed client ownership across `fork()`
@@ -170,6 +172,10 @@ async with foghttp.AsyncClient() as client:
   response body, and request completion lifecycle
 - opt-in typed transport policy hooks for lightweight request admission and
   response-head checks without default-path Python callbacks
+- opt-in Rust-owned retry policy for selected statuses and pre-header network
+  failures, with safe methods, replayable bodies, and immutable attempt traces
+- opt-in Rust-owned SSRF destination policy with per-hop allowlists,
+  post-resolution IP checks, and DNS rebinding mitigation
 - versioned telemetry snapshot metadata for `stats()`, `dump_transport_state()`,
   and `dump_pool_diagnostics()`
 - opt-in async lifecycle debug mode for active request snapshots, strict leak
@@ -178,17 +184,25 @@ async with foghttp.AsyncClient() as client:
   safety
 - shared Tokio runtime by default, with opt-in dedicated runtime worker tuning
 - grouped HTTP status constants and reusable HTTP method constants
+- client-level Basic and synchronous callable authentication with retry refresh
+  and cross-origin credential stripping
+- opt-in client-owned cookie jar with bounded domain/path/expiry matching,
+  redirect/retry coordination, and redacted diagnostics
 
 ## Documentation
 
 - [Documentation](https://github.com/AmberFog/foghttp/blob/main/docs/index.md)
 - [Quickstart](https://github.com/AmberFog/foghttp/blob/main/docs/quickstart.md)
 - [Request builder compatibility](https://github.com/AmberFog/foghttp/blob/main/docs/request-builder.md)
+- [Authentication](https://github.com/AmberFog/foghttp/blob/main/docs/auth.md)
+- [Cookies](https://github.com/AmberFog/foghttp/blob/main/docs/cookies.md)
 - [Client lifecycle](https://github.com/AmberFog/foghttp/blob/main/docs/lifecycle.md)
 - [Packaging and Python compatibility](https://github.com/AmberFog/foghttp/blob/main/docs/packaging.md)
 - [Timeout model](https://github.com/AmberFog/foghttp/blob/main/docs/timeouts.md)
 - [Upload typing contracts](https://github.com/AmberFog/foghttp/blob/main/docs/upload-types.md)
 - [Transport policy hooks](https://github.com/AmberFog/foghttp/blob/main/docs/policy-hooks.md)
+- [Retry policy](https://github.com/AmberFog/foghttp/blob/main/docs/retries.md)
+- [SSRF protection](https://github.com/AmberFog/foghttp/blob/main/docs/ssrf.md)
 - [Telemetry contract](https://github.com/AmberFog/foghttp/blob/main/docs/telemetry.md)
 - [Response streaming](https://github.com/AmberFog/foghttp/blob/main/docs/streaming.md)
 - [Proxy and trust_env](https://github.com/AmberFog/foghttp/blob/main/docs/proxies.md)
@@ -207,11 +221,13 @@ available as bytes/text/line context-managed APIs. Streaming `content=` uploads
 and multipart `files=` uploads are available with explicit replayability and
 cleanup rules. HTTP proxy routing and HTTPS proxy `CONNECT` tunnelling are
 available through `proxy=` and `trust_env=True` when the proxy endpoint itself
-uses `http://`.
-Cookies, auth helpers, HTTP/2, automatic `Accept-Encoding` negotiation,
-streaming decompression, and per-request connect timeout reconfiguration are
-planned for later versions. Physical connection caps currently apply to the
-HTTP/1.1 connector path; HTTP/2 will require separate stream-level limits.
+uses `http://`. Proxy-routed requests fail closed when `SSRFPolicy` is enabled
+because the client cannot prove which target address a remote proxy resolves.
+Provider-specific OAuth flows, HTTP/2, automatic `Accept-Encoding` negotiation,
+streaming decompression, and per-request connect timeout
+reconfiguration are planned for later versions. Physical connection caps
+currently apply to the HTTP/1.1 connector path; HTTP/2 will require separate
+stream-level limits.
 Response body read timeout is available for buffered and streaming response
 bodies; request body write timeout is available for buffered and streaming
 request bodies. Socket lifecycle telemetry is available for the current HTTP/1

{foghttp-0.3.7 → foghttp-0.3.9}/README.md

@@ -31,6 +31,8 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 - typed telemetry event hooks with redacted request/response lifecycle events
 - versioned telemetry snapshots that separate alert-oriented stats from
   diagnostic dump APIs
+- opt-in Rust-owned retries with replayability gates and immutable attempt
+  traces, plus opt-in per-hop and post-DNS SSRF destination controls
 - opt-in async lifecycle debug snapshots for staging and tests
 - lazy process-wide shared Tokio runtime by default, opt-in dedicated runtime
   tuning, and fail-closed client ownership across `fork()`
@@ -127,6 +129,10 @@ async with foghttp.AsyncClient() as client:
   response body, and request completion lifecycle
 - opt-in typed transport policy hooks for lightweight request admission and
   response-head checks without default-path Python callbacks
+- opt-in Rust-owned retry policy for selected statuses and pre-header network
+  failures, with safe methods, replayable bodies, and immutable attempt traces
+- opt-in Rust-owned SSRF destination policy with per-hop allowlists,
+  post-resolution IP checks, and DNS rebinding mitigation
 - versioned telemetry snapshot metadata for `stats()`, `dump_transport_state()`,
   and `dump_pool_diagnostics()`
 - opt-in async lifecycle debug mode for active request snapshots, strict leak
@@ -135,17 +141,25 @@ async with foghttp.AsyncClient() as client:
   safety
 - shared Tokio runtime by default, with opt-in dedicated runtime worker tuning
 - grouped HTTP status constants and reusable HTTP method constants
+- client-level Basic and synchronous callable authentication with retry refresh
+  and cross-origin credential stripping
+- opt-in client-owned cookie jar with bounded domain/path/expiry matching,
+  redirect/retry coordination, and redacted diagnostics
 
 ## Documentation
 
 - [Documentation](https://github.com/AmberFog/foghttp/blob/main/docs/index.md)
 - [Quickstart](https://github.com/AmberFog/foghttp/blob/main/docs/quickstart.md)
 - [Request builder compatibility](https://github.com/AmberFog/foghttp/blob/main/docs/request-builder.md)
+- [Authentication](https://github.com/AmberFog/foghttp/blob/main/docs/auth.md)
+- [Cookies](https://github.com/AmberFog/foghttp/blob/main/docs/cookies.md)
 - [Client lifecycle](https://github.com/AmberFog/foghttp/blob/main/docs/lifecycle.md)
 - [Packaging and Python compatibility](https://github.com/AmberFog/foghttp/blob/main/docs/packaging.md)
 - [Timeout model](https://github.com/AmberFog/foghttp/blob/main/docs/timeouts.md)
 - [Upload typing contracts](https://github.com/AmberFog/foghttp/blob/main/docs/upload-types.md)
 - [Transport policy hooks](https://github.com/AmberFog/foghttp/blob/main/docs/policy-hooks.md)
+- [Retry policy](https://github.com/AmberFog/foghttp/blob/main/docs/retries.md)
+- [SSRF protection](https://github.com/AmberFog/foghttp/blob/main/docs/ssrf.md)
 - [Telemetry contract](https://github.com/AmberFog/foghttp/blob/main/docs/telemetry.md)
 - [Response streaming](https://github.com/AmberFog/foghttp/blob/main/docs/streaming.md)
 - [Proxy and trust_env](https://github.com/AmberFog/foghttp/blob/main/docs/proxies.md)
@@ -164,11 +178,13 @@ available as bytes/text/line context-managed APIs. Streaming `content=` uploads
 and multipart `files=` uploads are available with explicit replayability and
 cleanup rules. HTTP proxy routing and HTTPS proxy `CONNECT` tunnelling are
 available through `proxy=` and `trust_env=True` when the proxy endpoint itself
-uses `http://`.
-Cookies, auth helpers, HTTP/2, automatic `Accept-Encoding` negotiation,
-streaming decompression, and per-request connect timeout reconfiguration are
-planned for later versions. Physical connection caps currently apply to the
-HTTP/1.1 connector path; HTTP/2 will require separate stream-level limits.
+uses `http://`. Proxy-routed requests fail closed when `SSRFPolicy` is enabled
+because the client cannot prove which target address a remote proxy resolves.
+Provider-specific OAuth flows, HTTP/2, automatic `Accept-Encoding` negotiation,
+streaming decompression, and per-request connect timeout
+reconfiguration are planned for later versions. Physical connection caps
+currently apply to the HTTP/1.1 connector path; HTTP/2 will require separate
+stream-level limits.
 Response body read timeout is available for buffered and streaming response
 bodies; request body write timeout is available for buffered and streaming
 request bodies. Socket lifecycle telemetry is available for the current HTTP/1

foghttp-0.3.9/docs/auth.md

@@ -0,0 +1,128 @@
+# Authentication
+
+FogHTTP provides a small client-level authentication API for Basic credentials
+and request-aware header refresh. Pass `auth=` to either `Client` or
+`AsyncClient`; both clients use the same synchronous contract.
+
+## Basic Authentication
+
+Pass a `(username, password)` tuple:
+
+```python
+import foghttp
+
+
+with foghttp.Client(auth=("service-user", "service-password")) as client:
+    response = client.get("https://api.example.com/me")
+    response.raise_for_status()
+```
+
+FogHTTP encodes the `username:password` payload as UTF-8 and then Base64. A
+username cannot contain `:` because that character separates the two fields;
+passwords may contain it. Use HTTPS because Basic credentials are encoded, not
+encrypted.
+
+## Callable Authentication
+
+A callable receives an immutable `AuthRequest` and returns any normal
+`HeaderSource`: a mapping, an iterable of pairs, `Headers`, or `None`.
+
+```python
+import foghttp
+
+
+def authenticate(request: foghttp.AuthRequest) -> dict[str, str]:
+    tenant = request.extensions["example.tenant"]
+    token = token_store.current_token(tenant)
+    return {"Authorization": f"Bearer {token}"}
+
+
+with foghttp.Client(auth=authenticate) as client:
+    response = client.get(
+        "https://api.example.com/me",
+        extensions={"example.tenant": "acme"},
+    )
+```
+
+`AuthRequest` contains the current method, URL, immutable header pairs,
+redirect-hop number, and request extensions. Before every snapshot, FogHTTP
+restores the auth-free header layer, including client defaults and per-request
+values, so refresh logic never sees or permanently replaces its stale output.
+Returning `None` or an empty header source removes the previous auth-managed
+values and leaves that lower layer in place.
+
+The hook runs at the start of every transport attempt, before request-slot and
+connection acquisition, including a retry and a same-origin redirect. A later
+pool/connection timeout can therefore end the attempt without sending bytes on
+the wire. The hook is synchronous, executes inline on a Rust transport worker
+thread, and may be called concurrently for concurrent requests. Keep it fast,
+thread-safe, independent of event-loop-local state, and do not re-enter the same
+client from the hook. Hook time advances the wall clock used by later total
+timeout checks, but a running callback is not preempted by FogHTTP timeouts,
+task cancellation, or `aclose()`. Once it returns after cancellation, the
+transport request remains aborted and does not acquire a slot or send bytes.
+Time-sensitive signatures must therefore tolerate the configured acquire
+delays. Coroutine functions and awaitable results are rejected.
+
+Hook exceptions propagate unchanged before the request acquires a transport
+slot. Auth does not silently fall back to stale credentials, and retry policy
+does not retry auth-hook failures.
+
+## Header Order And Prepared Requests
+
+Header precedence is:
+
+1. client default headers;
+2. auth-managed headers;
+3. per-request headers and body-generated semantic headers.
+
+An explicit per-request header therefore wins over a header with the same name
+returned by auth. FogHTTP also preserves a header added, changed, or deleted on
+a prepared `Request` after `build_request()`; auth does not overwrite that
+manual decision.
+
+```python
+with foghttp.Client(
+    headers={"Authorization": "Bearer default"},
+    auth=("service-user", "service-password"),
+) as client:
+    response = client.get(
+        "https://api.example.com/me",
+        headers={"Authorization": "Bearer one-request-token"},
+    )
+```
+
+Auth hooks cannot set transport-owned headers such as `Host`, `Content-Length`,
+`Transfer-Encoding`, `Connection`, or `Proxy-Authorization`.
+
+## Redirect Scope
+
+Same-origin redirects refresh auth for the new method and URL. On the first
+cross-origin redirect, FogHTTP removes every header actually managed by auth,
+including custom signature or API-key names, and disables auth for the rest of
+that logical request. The callback is not invoked for the new origin, even if a
+later redirect returns to the original origin.
+
+This rule is deliberately stricter than asking each callback to recognize a
+trust-boundary change. Explicit `Authorization` request headers are also
+removed by the normal cross-origin redirect header policy.
+
+## Redaction And Scope
+
+Basic credentials are reduced to the encoded header during configuration and
+are excluded from configuration repr. `AuthRequest` repr shows header and
+extension counts rather than values. Headers generated by an auth hook are
+marked sensitive dynamically, so their values are redacted from
+`Response.request` and redirect-history repr even when they use a vendor-specific
+name. FogHTTP telemetry does not record request headers.
+
+The callable itself is trusted code: it can read the request snapshot, and the
+contents of an exception raised by the callable remain the application's
+responsibility.
+
+The API is intentionally FogHTTP-native rather than compatible with
+`httpx.Auth`. The opt-in [cookie jar](./cookies.md) is a separate Rust-owned
+transport policy. If an auth hook supplies `Cookie`, that explicit value wins
+for the hop and the jar does not merge into it. OAuth flows, provider SDKs,
+async auth callables, and a public middleware framework remain outside this
+interface.

foghttp-0.3.9/docs/cookies.md

@@ -0,0 +1,112 @@
+# Cookies
+
+FogHTTP cookies are client-level, opt-in session state. The default remains
+stateless: `cookies=False` stores nothing and never adds a `Cookie` header.
+
+```python
+import foghttp
+
+
+with foghttp.Client(cookies=True) as client:
+    login = client.post(
+        "https://api.example.com/login",
+        json={"username": "ada", "password": "secret"},  # pragma: allowlist secret
+    )
+    login.raise_for_status()
+
+    profile = client.get("https://api.example.com/profile")
+    profile.raise_for_status()
+```
+
+`AsyncClient(cookies=True)` has the same behavior. The jar belongs to one
+client, is kept only in memory, and disappears with that client. Clients never
+share cookie state implicitly.
+
+## Matching And Storage
+
+The Rust transport owns the jar because redirects, retries, and streaming
+response headers are already managed there. Enabling cookies does not add a
+Python callback to each request.
+
+For every `Set-Cookie` response field, FogHTTP independently applies the
+following rules:
+
+- host-only and `Domain` cookies use HTTP cookie domain matching
+- `Path` uses segment-boundary matching; a missing or relative value uses the
+  request URL's default path
+- `Max-Age` takes precedence over tolerant HTTP cookie-date `Expires` parsing;
+  persistent lifetimes are capped at 400 days and expired cookies are removed
+- `Secure` cookies are accepted and sent only for HTTPS or a trustworthy
+  loopback origin
+- an insecure origin cannot overwrite or delete a matching secure cookie
+- `__Secure-` and `__Host-` name-prefix requirements are enforced
+- malformed or rejected fields do not prevent valid sibling fields from being
+  stored
+- nameless fields such as `Set-Cookie: session-token` are returned without an
+  equals sign, following the HTTP cookie retrieval algorithm
+
+Matching cookies are sent with longer paths first, then by creation order.
+Cookie values are opaque: supported ASCII header octets, including
+percent-looking values, are preserved exactly rather than decoded or
+canonicalized. Name/value pairs containing non-ASCII `obs-text` are ignored
+rather than transcoded across the Python/Rust string boundary. Cookie scope
+does not include the TCP port. Non-ASCII `Domain` attributes are rejected;
+ASCII punycode domains remain supported.
+
+Response headers update the jar before redirect or retry handling, before a
+buffered body is read, and before a streaming response is exposed. A cookie set
+on a retryable response can therefore be used by the next attempt. A body read
+failure does not roll back a valid `Set-Cookie` already received in the response
+headers.
+
+## Header Precedence And Redirects
+
+FogHTTP removes only its own previously attached `Cookie` header and selects
+again for every transport attempt and redirect hop. It never blindly forwards
+a managed cookie from the source URL to the redirect target.
+
+An explicit request, prepared-request, client-default, or auth-generated
+`Cookie` header wins for that hop. FogHTTP does not merge the jar into an
+explicit value. The existing redirect security policy preserves explicit
+cookies for same-origin redirects and removes them for cross-origin redirects;
+after removal, the jar may select cookies that independently match the target.
+
+Because HTTP cookies are scoped by host/domain and path rather than port, a
+cookie may be sent to another port on the same matching host. `Secure` still
+prevents sending a secure cookie over an untrusted plain-HTTP destination.
+
+## Capacity And Expiration
+
+The in-memory jar is bounded:
+
+- at most 4096 octets for the cookie name and value together
+- at most 16 KiB for one `Set-Cookie` field
+- at most 50 cookies per stored domain value
+- at most 3000 cookies per client
+
+Expired entries are removed first. When a domain limit is exceeded, non-secure
+cookies are evicted before secure cookies; equal-priority cookies and global
+overflow are ordered by least recent access. Servers must tolerate cookie
+eviction, as required for interoperable HTTP cookie use.
+
+## Redaction
+
+`Cookie` and `Set-Cookie` values are available through the normal header API,
+but their values are redacted from request, response, redirect-history, and
+header `repr()` output. Telemetry does not record request or response header
+values. The native jar has no public debug or inspection representation and
+does not log rejected cookie contents.
+
+## V1 Boundaries
+
+The v1 jar is an HTTP service-client feature, not a browser cookie engine:
+
+- no public-suffix list is applied; only accept `Domain` cookies from services
+  you trust not to set an overly broad suffix
+- `SameSite`, `Partitioned`, and browser third-party-cookie policy are not
+  enforced because FogHTTP has no browser top-level-site context
+- there is no persistent storage, public jar mutation/inspection API, or
+  automatic sharing between clients
+
+Use a browser automation stack when those browser security and privacy
+semantics are part of the application contract.

{foghttp-0.3.7 → foghttp-0.3.9}/docs/index.md

@@ -4,7 +4,7 @@ layout: "home"
 hero:
   name: "FogHTTP"
   text: "Rust-powered HTTP client for Python"
-  tagline: "Buffered JSON and form requests, streaming and multipart uploads, sync and async response streaming, transparent response decoding, base URL clients, default headers and params, sync and async APIs, redirects, custom CA certificates, cancellation, and observable request limits with pool diagnostics."
+  tagline: "Buffered JSON and form requests, streaming and multipart uploads, sync and async response streaming, transparent response decoding, base URL clients, default headers and params, opt-in cookies, safe retries and SSRF destination controls, redirects, custom CA certificates, cancellation, and observable request limits with pool diagnostics."
 
 features:
   - title: "Rust transport"
@@ -62,6 +62,14 @@ FogHTTP is designed around a few engineering priorities:
   events
 - opt-in typed transport policy hooks for lightweight request admission and
   response-head checks, with Rust-owned redirect safety
+- opt-in Rust-owned retry policy with safe-method defaults, replayability
+  gating, bounded backoff, typed decisions, and immutable attempt traces
+- opt-in Rust-owned SSRF destination policy with per-hop allowlists,
+  post-resolution IP checks, and DNS rebinding mitigation
+- client-level Basic authentication and synchronous request-aware auth hooks
+  with retry refresh and cross-origin credential stripping
+- opt-in client-owned cookie jar with bounded RFC-style domain, path, expiry,
+  redirect, and retry behavior
 - versioned telemetry snapshots that separate alert-oriented stats from
   diagnostic dump APIs
 - opt-in async lifecycle debug snapshots for tests, staging, and incident
@@ -74,11 +82,15 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 
 - [Quickstart](./quickstart.md)
 - [Request builder compatibility](./request-builder.md)
+- [Authentication](./auth.md)
+- [Cookies](./cookies.md)
 - [Client lifecycle](./lifecycle.md)
 - [Packaging and Python compatibility](./packaging.md)
 - [Timeout model](./timeouts.md)
 - [Upload typing contracts](./upload-types.md)
 - [Transport policy hooks](./policy-hooks.md)
+- [Retry policy](./retries.md)
+- [SSRF protection](./ssrf.md)
 - [Telemetry contract](./telemetry.md)
 - [Response streaming](./streaming.md)
 - [TLS trust](./tls.md)
@@ -98,6 +110,10 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 - cancellable buffered async requests
 - bounded sync and async response streaming
 - prepared requests that can be inspected before sending
+- opt-in safe retries with request-scoped attempt diagnostics
+- client-level Basic or callable authentication with explicit redirect scope
+- direct service clients that need an opt-in SSRF guard for partially trusted
+  destination URLs
 - simple benchmarks against other buffered HTTP clients
 
 ## Key Features
@@ -106,6 +122,8 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 - `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, and RFC 10008 `QUERY`
 - `base_url` for reusable API clients and relative request paths
 - default client headers and query params for reusable API clients
+- client-level `auth=` for Basic credentials or synchronous header refresh
+- opt-in `cookies=True` session state; see [Cookies](./cookies.md)
 - query params with repeated keys, JSON, form-urlencoded data, buffered
   bytes/text bodies, file-like bodies, streaming bytes-like iterables, and
   multipart `files=` uploads
@@ -136,6 +154,10 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
   response body, and request completion lifecycle
 - opt-in typed transport policy hooks with immutable request/response views and
   no default-path Python callback
+- opt-in retry policy for selected statuses and pre-header network failures,
+  with safe methods, replayable bodies, and immutable attempt traces
+- opt-in SSRF destination policy that validates initial and redirected targets,
+  then pins each connection attempt to its checked DNS result
 - versioned telemetry snapshot metadata for `stats()`, `dump_transport_state()`,
   and `dump_pool_diagnostics()`
 - opt-in async lifecycle debug mode for active request snapshots and strict
@@ -148,8 +170,8 @@ try to keep public interfaces stable and avoid unnecessary breaking changes.
 
 ## Not Yet
 
-FogHTTP does not yet implement cookies, HTTP/2, automatic `Accept-Encoding`
-negotiation, streaming decompression, or advanced authentication helpers.
+FogHTTP does not yet implement HTTP/2, automatic `Accept-Encoding` negotiation,
+streaming decompression, or provider-specific authentication flows.
 `trust_env` supports HTTP proxy routing, HTTPS
 `CONNECT` tunnelling through `http://` proxy endpoints, and `SSL_CERT_FILE`.
 Disabling TLS verification is intentionally not supported. See

{foghttp-0.3.7 → foghttp-0.3.9}/docs/lifecycle.md

@@ -268,6 +268,12 @@ Calling `aclose()` closes the async client for everyone using it, cancels
 in-flight async requests, aborts active async streamed response bodies, and then
 shuts down the Rust transport.
 
+Cancellation is cooperative at Rust future boundaries. A synchronous auth hook
+that is already executing cannot be preempted by task cancellation or
+`aclose()`; it may continue until the callback returns. The transport request is
+still aborted and holds no request slot or socket because auth runs before
+acquisition.
+
 ```python
 import asyncio
 
@@ -527,9 +533,11 @@ if diagnostics["pending_requests"]:
 ## Current Boundaries
 
 The lifecycle contract currently applies to buffered requests/responses,
-sync/async streamed response bodies, and streaming request bodies passed through
-`content=`. Cookies and advanced auth helpers are planned later and may extend
-the lifecycle model.
+sync/async streamed response bodies, streaming request bodies passed through
+`content=`, synchronous callable auth hooks, and the opt-in cookie jar. Cookie
+state belongs to one client and disappears when that client is closed or
+dropped; it is never persisted or shared globally. Provider-specific
+authentication flows may extend the lifecycle model later.
 
 FogHTTP exposes socket lifecycle telemetry for the current HTTP/1 path, but
 HTTP/2 stream-level connection limits are planned with HTTP/2 support rather