python-tls-client 1.0.3__py3-none-any.whl → 1.0.4__py3-none-any.whl

python_tls_client-1.0.4.dist-info/METADATA

@@ -0,0 +1,364 @@
+Metadata-Version: 2.4
+Name: python-tls-client
+Version: 1.0.4
+Summary: Advanced Python HTTP Client with TLS fingerprint spoofing (fork with binary-response fix and certificate pinning)
+Author: Emanuele Scarlata
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Fenix46/Python-Tls-Client
+Project-URL: Source, https://github.com/Fenix46/Python-Tls-Client
+Project-URL: Original, https://github.com/FlorianREGAZ/Python-Tls-Client
+Classifier: Environment :: Web Environment
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: Unix
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typing-extensions
+Dynamic: license-file
+
+# Python-TLS-Client
+
+Advanced Python HTTP client with TLS fingerprint spoofing, built on
+[bogdanfinn/tls-client](https://github.com/bogdanfinn/tls-client) and inspired
+by [requests](https://github.com/psf/requests).
+
+> **Fork notice:** this is a fork of
+> [Python-Tls-Client](https://github.com/FlorianREGAZ/Python-Tls-Client) by
+> Florian Zager, published on PyPI under a different name
+> (`python-tls-client`) because the original name `tls-client` is already
+> taken by an unrelated project. The importable module is unchanged:
+> `import tls_client`.
+>
+> Changes on top of the original:
+> - Fixed corruption of binary response bodies (protobuf, images, ...) — see [Changelog](#changelog) 1.0.2 / 1.0.3
+> - Certificate pinning — see [Changelog](#changelog) 1.0.1
+> - Typed exceptions, safer session lifecycle, clearer native-library load errors — see [Changelog](#changelog) 1.0.4
+> - Native binaries updated to `bogdanfinn/tls-client` v1.16.0, fixing a musl/glibc mismatch on Linux (Chrome 150/152, Firefox 147/148, Brave 146, HTTP/3 over SOCKS5, session ticket control, ...) — see [Changelog](#changelog) 1.0.4
+
+## Installation
+
+```bash
+pip install python-tls-client
+```
+
+## Quick start
+
+The API is intentionally close to [requests](https://github.com/psf/requests),
+so most of what you already know carries over directly.
+
+```python
+import tls_client
+
+session = tls_client.Session(
+    client_identifier="chrome_150",
+    random_tls_extension_order=True,
+)
+
+response = session.get(
+    "https://www.example.com/",
+    headers={"key1": "value1"},
+    proxy="http://user:password@host:port",
+)
+
+print(response.status_code, response.text)
+```
+
+Available `client_identifier` presets (see `tls_client/settings.py` for the
+full, up-to-date list — kept in sync with the
+[`MappedTLSClients`](https://github.com/bogdanfinn/tls-client/blob/v1.16.0/profiles/profiles.go)
+map of the native library version shipped in `tls_client/dependencies/`,
+currently v1.16.0):
+
+| Browser  | Identifiers |
+|----------|-------------|
+| Chrome   | `chrome_103`...`chrome_112`, `chrome_116_PSK`, `chrome_116_PSK_PQ`, `chrome_117`, `chrome_120`, `chrome_124`, `chrome_130_PSK`, `chrome_131(_PSK)`, `chrome_133(_PSK)`, `chrome_144(_PSK)`, `chrome_146(_PSK)`, `chrome_150(_PSK)`, `chrome_152(_PSK)` |
+| Brave    | `brave_146`, `brave_146_PSK` |
+| Firefox  | `firefox_102`...`firefox_110`, `firefox_117`, `firefox_120`, `firefox_123`, `firefox_132`, `firefox_133`, `firefox_135`, `firefox_146_PSK`, `firefox_147(_PSK)`, `firefox_148` |
+| Opera    | `opera_89`, `opera_90`, `opera_91` |
+| Safari   | `safari_15_6_1`, `safari_16_0` |
+| iOS      | `safari_ios_15_5`, `safari_ios_15_6`, `safari_ios_16_0`, `safari_ios_17_0`, `safari_ios_18_0`, `safari_ios_18_5`, `safari_ios_26_0` |
+| iPadOS   | `safari_ipad_15_6` |
+| Android  | `okhttp4_android_7` through `okhttp4_android_13` |
+
+> Only `chrome_144`, `chrome_144_PSK`, `firefox_147`, `firefox_147_PSK` and
+> `firefox_148` carry an HTTP/3 fingerprint matching the real browser; every
+> other profile sends a minimal, non-representative SETTINGS frame if you
+> end up negotiating HTTP/3. This doesn't affect the TLS or HTTP/2
+> fingerprint. Use `disable_http3=True` (see below) if the HTTP/3 fingerprint
+> matters and you're not using one of those five profiles.
+
+## Releasing the session
+
+Every `Session` holds native resources (a connection pool) in the underlying
+Go library that must be released explicitly. Always use the context manager,
+or call `.close()` yourself:
+
+```python
+with tls_client.Session(client_identifier="chrome_150") as session:
+    response = session.get("https://www.example.com/")
+# session is closed automatically here
+```
+
+If you forget, the session emits a `ResourceWarning` and does a best-effort
+cleanup when it is garbage collected — but that isn't guaranteed to run
+promptly (or at all), so don't rely on it in production code.
+
+## Custom TLS fingerprint
+
+Instead of a `client_identifier` preset, you can fully customize the TLS/HTTP2
+fingerprint:
+
+```python
+import tls_client
+
+session = tls_client.Session(
+    ja3_string=(
+        "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-"
+        "156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0"
+    ),
+    h2_settings={
+        "HEADER_TABLE_SIZE": 65536,
+        "MAX_CONCURRENT_STREAMS": 1000,
+        "INITIAL_WINDOW_SIZE": 6291456,
+        "MAX_HEADER_LIST_SIZE": 262144,
+    },
+    h2_settings_order=[
+        "HEADER_TABLE_SIZE",
+        "MAX_CONCURRENT_STREAMS",
+        "INITIAL_WINDOW_SIZE",
+        "MAX_HEADER_LIST_SIZE",
+    ],
+    supported_signature_algorithms=[
+        "ECDSAWithP256AndSHA256",
+        "PSSWithSHA256",
+        "PKCS1WithSHA256",
+        "ECDSAWithP384AndSHA384",
+        "PSSWithSHA384",
+        "PKCS1WithSHA384",
+        "PSSWithSHA512",
+        "PKCS1WithSHA512",
+    ],
+    supported_versions=["GREASE", "1.3", "1.2"],
+    key_share_curves=["GREASE", "X25519"],
+    cert_compression_algo="brotli",
+    pseudo_header_order=[":method", ":authority", ":scheme", ":path"],
+    connection_flow=15663105,
+    header_order=["accept", "user-agent", "accept-encoding", "accept-language"],
+)
+
+response = session.post(
+    "https://www.example.com/",
+    headers={"key1": "value1"},
+    json={"key1": "key2"},
+)
+```
+
+### Additional fingerprint and connection controls (v1.16.0+)
+
+```python
+import tls_client
+
+session = tls_client.Session(
+    client_identifier="chrome_150",
+    # Disable TLS session ticket caching/resumption
+    disable_session_tickets=True,
+    # Force HTTP/2, even for a profile that would otherwise try HTTP/3
+    disable_http3=True,
+)
+```
+
+For a custom client (`client_identifier=None`), you can additionally set:
+
+```python
+session = tls_client.Session(
+    client_identifier=None,
+    ja3_string="...",
+    alpn_protocols=["h2", "http/1.1"],
+    alps_protocols=["h2"],
+    # Required if ja3_string lists TLS extension 51764 (trust_anchors)
+    trust_anchors_payload="...",
+)
+```
+
+## Certificate pinning
+
+Restrict which server certificates are accepted for given hosts by passing
+their pinned public key hashes (SPKI, base64-encoded SHA-256 — the same
+format used by HPKP `pin-sha256` and most certificate-pinning tooling):
+
+```python
+import tls_client
+
+session = tls_client.Session(
+    client_identifier="chrome_150",
+    certificate_pinning={
+        "example.com": [
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",  # backup pin
+        ],
+    },
+)
+
+response = session.get("https://example.com/")
+```
+
+Requests to a pinned host whose certificate doesn't match any of the given
+pins raise `tls_client.TLSClientCertificateError` (see
+[Error handling](#error-handling)). Including a backup pin is recommended so
+rotating the leaf certificate doesn't lock you out.
+
+## Error handling
+
+Failures originating from the underlying Go client are raised as
+`TLSClientExeption` (kept misspelled for backwards compatibility) or one of
+its more specific subclasses, so you can catch broadly or narrowly:
+
+```python
+from tls_client import (
+    TLSClientExeption,
+    TLSClientTimeoutError,
+    TLSClientProxyError,
+    TLSClientConnectionError,
+    TLSClientCertificateError,
+)
+
+try:
+    response = session.get("https://example.com/", timeout_seconds=5)
+except TLSClientTimeoutError:
+    ...  # request exceeded timeout_seconds
+except TLSClientProxyError:
+    ...  # the configured proxy refused/rejected the connection
+except TLSClientConnectionError:
+    ...  # DNS, TCP, or TLS handshake failure
+except TLSClientCertificateError:
+    ...  # response failed certificate pinning validation
+except TLSClientExeption:
+    ...  # any other backend error
+```
+
+All four subclasses inherit from `TLSClientExeption`, so existing code that
+only catches the base class keeps working unchanged. Classification is
+best-effort pattern matching on the backend's error message (it doesn't
+expose a structured error code) and falls back to the base exception when
+the message doesn't match a known pattern.
+
+## Packaging with PyInstaller / PyArmor
+
+The compiled native library ships inside `tls_client/dependencies/` and needs
+to be included explicitly when bundling with PyInstaller or PyArmor.
+
+| Platform                | `--add-binary` argument |
+|--------------------------|--------------------------|
+| Linux (x86, 32-bit)      | `'{path_to_library}/tls_client/dependencies/tls-client-x86.so:tls_client/dependencies'` |
+| Linux (AMD64 / x86_64)   | `'{path_to_library}/tls_client/dependencies/tls-client-amd64.so:tls_client/dependencies'` |
+| macOS (Intel)            | `'{path_to_library}/tls_client/dependencies/tls-client-x86.dylib:tls_client/dependencies'` |
+| macOS (Apple Silicon)    | `'{path_to_library}/tls_client/dependencies/tls-client-arm64.dylib:tls_client/dependencies'` |
+| Windows (64-bit)         | `'{path_to_library}/tls_client/dependencies/tls-client-64.dll;tls_client/dependencies'` |
+
+## Development
+
+```bash
+pip install -r requirements.txt
+python -m unittest discover -s tests -p "test_unit_*.py" -v
+```
+
+`tests/test_unit_*.py` are network-free and run in CI on every push and pull
+request. `tests/test_binary_response.py` is a regression suite that hits
+httpbin.org and is meant for manual local runs (`python -m pytest tests/ -v`),
+not CI.
+
+## Acknowledgements
+
+Big shout out to [Bogdanfinn](https://github.com/bogdanfinn) for open
+sourcing [tls-client](https://github.com/bogdanfinn/tls-client) in Go, and to
+[FlorianREGAZ](https://github.com/FlorianREGAZ) for the original Python
+wrapper this project is forked from. The syntax stays close to
+[requests](https://github.com/psf/requests) since most people already know it.
+
+## Changelog
+
+### 1.0.4
+- **Fixed**: the Linux `.so` binaries published in `1.0.3` on PyPI
+  (`tls-client-amd64.so`, and likely the other Linux binaries from that
+  build) were linked against musl libc instead of glibc, causing
+  `OSError: ... libc.musl-x86_64.so.1` on any glibc-based distro (Ubuntu,
+  Debian, most standard LXC containers — anything that isn't Alpine).
+  The v1.16.0 binaries in this update were downloaded from upstream's
+  `*-ubuntu-*` release assets and confirmed glibc-linked (checked for
+  `GLIBC_*` version symbols and the absence of a `libc.musl` dependency).
+- **Breaking**: `Session`'s default `client_identifier` changed from
+  `chrome_120` to `chrome_150` (matching the v1.16.0 native library's own
+  default profile). `chrome_120` imitates a browser version no longer in
+  circulation, which made it a distinguishing fingerprint rather than a
+  neutral one; pin `client_identifier="chrome_120"` explicitly if you
+  relied on the old default.
+- **Added**: typed exception hierarchy (`TLSClientTimeoutError`,
+  `TLSClientProxyError`, `TLSClientConnectionError`,
+  `TLSClientCertificateError`), all subclasses of the existing
+  `TLSClientExeption` so current `except` clauses keep working.
+- **Added**: `Session` now warns (`ResourceWarning`) and best-effort
+  auto-closes if garbage collected without an explicit `close()` call.
+- **Fixed**: native library load failures now raise a clear `OSError`
+  naming the platform, architecture, and resolved library path instead of
+  a raw, hard-to-diagnose `ctypes` error.
+- **Fixed**: invalid/misleading type hints in `Session.__init__` (bare
+  `Optional` on `bool` parameters, `str` instead of `Optional[str]`).
+- **Added**: network-free unit tests (`tests/test_unit_*.py`) and a CI
+  workflow that runs them on every push and pull request.
+- **Updated**: precompiled native binaries bumped from
+  `bogdanfinn/tls-client` ~v1.7.x to v1.16.0. Newest previously available
+  profile was `chrome_120`/`firefox_120` (obsolete browser versions by
+  2026, which made the fingerprint itself a distinguishing signal). Now
+  includes Chrome 150/152, Firefox 147/148, Brave 146, and 20+ other new
+  profiles — see the [client identifier table](#quick-start) above. Verified
+  against a live handshake (`chrome_150` against tls.peet.ws) and against
+  the full existing test suite (unit tests + the httpbin-backed binary
+  response regression suite) on macOS arm64.
+- **Added**: `Session` parameters `alpn_protocols`, `alps_protocols`,
+  `trust_anchors_payload` (custom client only), `disable_session_tickets`,
+  `disable_http3`, exposing v1.16.0 request fields. All default to the
+  previous behavior, so existing calls are unaffected.
+- **Fixed**: `cert_compression_algo` now sends `certCompressionAlgos`
+  (the v1.16.0 field name, plural/list) internally instead of the old
+  singular `certCompressionAlgo`, which the new binary silently ignored.
+  The public parameter itself is unchanged.
+- **Fixed**: `ClientIdentifiers` type list corrected — `safari_ipad_15_6`
+  was previously listed as a duplicate of `safari_ios_15_6`, making the
+  real iPadOS identifier inaccessible through the type; `confirmed_android_2`
+  removed as it was never a valid identifier in any checked upstream version.
+
+### 1.0.3
+- **Fixed**: on Linux, 64-bit x86 machines (`platform.machine() == "x86_64"`)
+  were incorrectly matched by the `"x86" in machine()` check in `cffi.py`
+  and loaded the 32-bit `tls-client-x86.so` binary instead of the 64-bit
+  `tls-client-amd64.so`, causing the native library to fail to load on the
+  vast majority of Linux hosts. `machine()` is now matched explicitly
+  against `x86_64`/`amd64`/`AMD64` before falling back to the 32-bit binary.
+
+### 1.0.2
+- **Fixed**: binary response bodies (protobuf, images, ...) were corrupted
+  by a UTF-8 `byteReplacer` (U+FFFD) inside the Go C library. Every byte
+  greater than 127 that did not form a valid UTF-8 sequence was replaced by
+  `EF BF BD`.
+  - `sessions.py` now sends `isByteResponse: True` in the request payload
+    so the backend returns the body as a base64 data-URI.
+  - `response.py`'s `build_response` decodes the data-URI back to raw
+    bytes for `Response.content`; `Response.text` is a UTF-8 view (with
+    replacement characters for invalid sequences).
+- Added `tests/test_binary_response.py` (regression suite, needs network).
+
+### 1.0.1
+- Certificate pinning.

python_tls_client-1.0.4.dist-info/RECORD

@@ -0,0 +1,22 @@
+python_tls_client-1.0.4.dist-info/licenses/LICENSE,sha256=issbIg7ujiqhtvXsx5mmKhdeZ6zd39ew_nEzvvwImfw,1123
+tls_client/__init__.py,sha256=pa9nyTBgrTRUPcEH7m3A8_U2s69AdTGECp5MfyO9kbs,819
+tls_client/__version__.py,sha256=MTezpEv9Aa9fBY5Q8ToVM6LirC8gjSdxLRjv-NCF1to,445
+tls_client/cffi.py,sha256=BMtpaZp87ZyuPslNF41eVMygmhDI5ilrjJXJc2_fBqE,1570
+tls_client/cookies.py,sha256=5ujSFL6V8bDMCH8Mow6qoj5dP5GjfMJTd8_jWottvpM,15153
+tls_client/exceptions.py,sha256=MELEkIjO410QTYls9UDbUuJlG_PstAv5ysao-WTcDJU,1917
+tls_client/response.py,sha256=5Ji09s3fnrSst3N5n61fJ7motHNF3Jjsk6WBmsZ6iOk,3126
+tls_client/sessions.py,sha256=JlSR5m77OffjY25_aCuEJAZjk-qZm_i1FdCWPaUpDCw,21322
+tls_client/settings.py,sha256=nhpow6IsksoZw-u3yWBFvvQaSM-u23eBWRcCxxoVodo,2376
+tls_client/structures.py,sha256=zb1wflxxWoKFqe8NMT2qEvIh7RA-kN459ZcNhW8p_Uo,2443
+tls_client/dependencies/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tls_client/dependencies/tls-client-32.dll,sha256=UgOjb4DqP5zfpDvwcqd1cC0YAqy45DBOeJBSEPZ90q8,24192773
+tls_client/dependencies/tls-client-64.dll,sha256=U9ymNrMtll7m_kVi8535WbIGP-uqPXQO-pJdGHPPEdc,27843480
+tls_client/dependencies/tls-client-amd64.so,sha256=LshTSWY0VF56fqAocVdjlI1Vu92XrKfsqp_qjC67CN8,17379216
+tls_client/dependencies/tls-client-arm64.dylib,sha256=mZhNATkhx1OrKdKHIMsJnv9q32NTg0fhNlLLXP5b3AI,11884770
+tls_client/dependencies/tls-client-arm64.so,sha256=45hiL5nAzo_MtQ_25BTzc7WTKgJ37OkEaKeWmS8K5Rg,16413368
+tls_client/dependencies/tls-client-x86.dylib,sha256=ZGNFfqcTqWs7jJT9nYdG57xRDLZ4T88PS7ZNnIPjJRo,12584208
+tls_client/dependencies/tls-client-x86.so,sha256=XqgTCOU-I22uc7Nb1KCa8SARkcMnE-opaLhbvP6UthY,16210792
+python_tls_client-1.0.4.dist-info/METADATA,sha256=CatC2OhRC7AydypRfQyp4HfEtqUmflhTYB3nloaQQvY,15461
+python_tls_client-1.0.4.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+python_tls_client-1.0.4.dist-info/top_level.txt,sha256=yLrfQtbTRfECzPN62knWdGNmbhcPRev1grCAMuEsEz0,11
+python_tls_client-1.0.4.dist-info/RECORD,,

tls_client/__init__.py

@@ -12,4 +12,11 @@
 # tls-client: https://github.com/bogdanfinn/tls-client
 # requests: https://github.com/psf/requests
 
-from .sessions import Session
+from .sessions import Session
+from .exceptions import (
+    TLSClientExeption,
+    TLSClientTimeoutError,
+    TLSClientProxyError,
+    TLSClientConnectionError,
+    TLSClientCertificateError,
+)

tls_client/__version__.py

@@ -6,6 +6,6 @@
 
 __title__ = "tls_client"
 __description__ = "Advanced Python HTTP Client (fork with binary-response fix and certificate pinning)."
-__version__ = "1.0.3"
+__version__ = "1.0.4"
 __author__ = "Emanuele Scarlata"
 __license__ = "MIT"

tls_client/cffi.py

@@ -17,7 +17,19 @@ else:
         file_ext = '-x86.so'
 
 root_dir = os.path.abspath(os.path.dirname(__file__))
-library = ctypes.cdll.LoadLibrary(f'{root_dir}/dependencies/tls-client{file_ext}')
+library_path = f'{root_dir}/dependencies/tls-client{file_ext}'
+
+try:
+    library = ctypes.cdll.LoadLibrary(library_path)
+except OSError as exc:
+    raise OSError(
+        f"Failed to load the native tls-client library for this platform "
+        f"(platform={platform!r}, machine={machine()!r}) from {library_path!r}. "
+        "The binary may be missing from the package, incompatible with this "
+        "OS/architecture, or blocked by the OS (e.g. macOS Gatekeeper). "
+        "If you believe this platform should be supported, please open an "
+        "issue at https://github.com/Fenix46/Python-Tls-Client/issues."
+    ) from exc
 
 # extract the exposed request function from the shared package
 request = library.request

tls_client/exceptions.py

@@ -1,3 +1,51 @@
 
 class TLSClientExeption(IOError):
-    """General error with the TLS client"""
+    """General error with the TLS client"""
+
+
+class TLSClientTimeoutError(TLSClientExeption):
+    """The request did not complete within ``timeout_seconds``."""
+
+
+class TLSClientProxyError(TLSClientExeption):
+    """The proxy refused the connection, timed out, or rejected the credentials."""
+
+
+class TLSClientConnectionError(TLSClientExeption):
+    """The connection to the target host could not be established (DNS, TCP, TLS handshake)."""
+
+
+class TLSClientCertificateError(TLSClientExeption):
+    """The server certificate did not match the configured certificate pin."""
+
+
+# Substrings looked up (case-insensitively) in the Go backend's error message
+# to classify it into one of the typed exceptions above. The backend
+# (bogdanfinn/tls-client) does not expose a structured error code, only this
+# free-text message, so this is best-effort pattern matching kept close to
+# the strings the Go client is known to emit.
+_ERROR_PATTERNS = (
+    ("certificate", TLSClientCertificateError),
+    ("pin", TLSClientCertificateError),
+    ("proxy", TLSClientProxyError),
+    ("timeout", TLSClientTimeoutError),
+    ("deadline exceeded", TLSClientTimeoutError),
+    ("no such host", TLSClientConnectionError),
+    ("connection refused", TLSClientConnectionError),
+    ("connection reset", TLSClientConnectionError),
+    ("dial tcp", TLSClientConnectionError),
+    ("eof", TLSClientConnectionError),
+)
+
+
+def build_exception(message: str) -> TLSClientExeption:
+    """Map a Go backend error message to the most specific matching exception.
+
+    Falls back to the base ``TLSClientExeption`` when nothing matches, so
+    callers that only catch the base class keep working unchanged.
+    """
+    lowered = (message or "").lower()
+    for pattern, exception_cls in _ERROR_PATTERNS:
+        if pattern in lowered:
+            return exception_cls(message)
+    return TLSClientExeption(message)

tls_client/sessions.py

@@ -1,6 +1,6 @@
 from .cffi import request, freeMemory, destroySession
 from .cookies import cookiejar_from_dict, merge_cookies, extract_cookies_to_jar
-from .exceptions import TLSClientExeption
+from .exceptions import build_exception
 from .response import build_response, Response
 from .settings import ClientIdentifiers
 from .structures import CaseInsensitiveDict
@@ -18,7 +18,7 @@ class Session:
 
     def __init__(
         self,
-        client_identifier: ClientIdentifiers = "chrome_120",
+        client_identifier: ClientIdentifiers = "chrome_150",
         ja3_string: Optional[str] = None,
         h2_settings: Optional[Dict[str, int]] = None,
         h2_settings_order: Optional[List[str]] = None,
@@ -26,20 +26,26 @@ class Session:
         supported_delegated_credentials_algorithms: Optional[List[str]] = None,
         supported_versions: Optional[List[str]] = None,
         key_share_curves: Optional[List[str]] = None,
-        cert_compression_algo: str = None,
-        additional_decode: str = None,
+        cert_compression_algo: Optional[str] = None,
+        additional_decode: Optional[str] = None,
         pseudo_header_order: Optional[List[str]] = None,
         connection_flow: Optional[int] = None,
         priority_frames: Optional[list] = None,
         header_order: Optional[List[str]] = None,
         header_priority: Optional[List[str]] = None,
-        random_tls_extension_order: Optional = False,
-        force_http1: Optional = False,
-        catch_panics: Optional = False,
-        debug: Optional = False,
+        random_tls_extension_order: bool = False,
+        force_http1: bool = False,
+        catch_panics: bool = False,
+        debug: bool = False,
         certificate_pinning: Optional[Dict[str, List[str]]] = None,
+        alpn_protocols: Optional[List[str]] = None,
+        alps_protocols: Optional[List[str]] = None,
+        trust_anchors_payload: Optional[str] = None,
+        disable_session_tickets: bool = False,
+        disable_http3: bool = False,
     ) -> None:
         self._session_id = str(uuid.uuid4())
+        self._closed = False
         # --- Standard Settings ----------------------------------------------------------------------------------------
 
         # Case-insensitive dictionary of headers, send on each request
@@ -278,6 +284,24 @@ class Session:
         # debugging
         self.debug = debug
 
+        # ALPN protocols offered during the TLS handshake for a custom client
+        # Example: ["h2", "http/1.1"]
+        self.alpn_protocols = alpn_protocols
+
+        # ALPS protocols (Application-Layer Protocol Settings) for a custom client
+        self.alps_protocols = alps_protocols
+
+        # Trust anchors payload for the TLS 1.3 "trust_anchors" extension.
+        # Required when ja3_string lists extension 51764; pass "" (default
+        # None here) to keep the previous behaviour.
+        self.trust_anchors_payload = trust_anchors_payload
+
+        # Disable TLS session ticket caching and resumption
+        self.disable_session_tickets = disable_session_tickets
+
+        # Disable HTTP/3, even for profiles that would otherwise use it
+        self.disable_http3 = disable_http3
+
     def __enter__(self):
         return self
 
@@ -298,9 +322,32 @@ class Session:
         destroy_session_response_object = loads(destroy_session_response_string)
 
         freeMemory(destroy_session_response_object['id'].encode('utf-8'))
+        self._closed = True
 
         return destroy_session_response_string
 
+    def __del__(self):
+        # Safety net for callers who forget to call close() or use the `with`
+        # statement: the Go backend keeps the session (and its connection
+        # pool) alive until destroySession() is called, so a forgotten
+        # session leaks native memory for the life of the process.
+        if not getattr(self, "_closed", True):
+            import warnings
+            warnings.warn(
+                f"Session {self._session_id} was never closed; call session.close() "
+                "or use it as a context manager (`with tls_client.Session() as session`) "
+                "to release the native TLS client resources.",
+                ResourceWarning,
+                stacklevel=2,
+            )
+            try:
+                self.close()
+            except Exception:
+                # Best-effort cleanup during garbage collection / interpreter
+                # shutdown; the native library or event loop it depends on
+                # may already be gone.
+                pass
+
     def execute_request(
         self,
         method: str,
@@ -409,6 +456,8 @@ class Session:
             "requestBody": base64.b64encode(request_body).decode() if is_byte_request else request_body,
             "requestCookies": request_cookies,
             "timeoutSeconds": timeout_seconds,
+            "disableSessionTickets": self.disable_session_tickets,
+            "disableHttp3": self.disable_http3,
         }
         if certificate_pinning:
             request_payload["certificatePinningHosts"] = certificate_pinning
@@ -421,11 +470,17 @@ class Session:
                 "connectionFlow": self.connection_flow,
                 "priorityFrames": self.priority_frames,
                 "headerPriority": self.header_priority,
-                "certCompressionAlgo": self.cert_compression_algo,
+                # certCompressionAlgos (plural) takes a list as of tls-client
+                # v1.16.0's CustomTlsClient schema; wrap the single algorithm
+                # this wrapper still accepts as a one-element list.
+                "certCompressionAlgos": [self.cert_compression_algo] if self.cert_compression_algo else None,
                 "supportedVersions": self.supported_versions,
                 "supportedSignatureAlgorithms": self.supported_signature_algorithms,
                 "supportedDelegatedCredentialsAlgorithms": self.supported_delegated_credentials_algorithms ,
                 "keyShareCurves": self.key_share_curves,
+                "alpnProtocols": self.alpn_protocols,
+                "alpsProtocols": self.alps_protocols,
+                "trustAnchorsPayload": self.trust_anchors_payload,
             }
         else:
             request_payload["tlsClientIdentifier"] = self.client_identifier
@@ -444,7 +499,7 @@ class Session:
         # --- Response -------------------------------------------------------------------------------------------------
         # Error handling
         if response_object["status"] == 0:
-            raise TLSClientExeption(response_object["body"])
+            raise build_exception(response_object["body"])
         # Set response cookies
         response_cookie_jar = extract_cookies_to_jar(
             request_url=url,

tls_client/settings.py

@@ -1,5 +1,12 @@
 from typing_extensions import Literal, TypeAlias
 
+# Keep this list in sync with the `MappedTLSClients` map in
+# bogdanfinn/tls-client's profiles/profiles.go for the version of the
+# native binaries shipped in tls_client/dependencies/ (currently v1.16.0).
+# Passing a string that isn't in that map fails at the native layer, not
+# here, so an outdated list here just breaks autocomplete/typing, not
+# runtime behavior. Source:
+# https://github.com/bogdanfinn/tls-client/blob/v1.16.0/profiles/profiles.go
 ClientIdentifiers: TypeAlias = Literal[
     # Chrome
     "chrome_103",
@@ -16,6 +23,23 @@ ClientIdentifiers: TypeAlias = Literal[
     "chrome_116_PSK_PQ",
     "chrome_117",
     "chrome_120",
+    "chrome_124",
+    "chrome_130_PSK",
+    "chrome_131",
+    "chrome_131_PSK",
+    "chrome_133",
+    "chrome_133_PSK",
+    "chrome_144",
+    "chrome_144_PSK",
+    "chrome_146",
+    "chrome_146_PSK",
+    "chrome_150",
+    "chrome_150_PSK",
+    "chrome_152",
+    "chrome_152_PSK",
+    # Brave
+    "brave_146",
+    "brave_146_PSK",
     # Safari
     "safari_15_6_1",
     "safari_16_0",
@@ -23,8 +47,12 @@ ClientIdentifiers: TypeAlias = Literal[
     "safari_ios_15_5",
     "safari_ios_15_6",
     "safari_ios_16_0",
+    "safari_ios_17_0",
+    "safari_ios_18_0",
+    "safari_ios_18_5",
+    "safari_ios_26_0",
     # iPadOS (Safari)
-    "safari_ios_15_6",
+    "safari_ipad_15_6",
     # FireFox
     "firefox_102",
     "firefox_104",
@@ -34,6 +62,14 @@ ClientIdentifiers: TypeAlias = Literal[
     "firefox_110",
     "firefox_117",
     "firefox_120",
+    "firefox_123",
+    "firefox_132",
+    "firefox_133",
+    "firefox_135",
+    "firefox_146_PSK",
+    "firefox_147",
+    "firefox_147_PSK",
+    "firefox_148",
     # Opera
     "opera_89",
     "opera_90",
@@ -51,14 +87,17 @@ ClientIdentifiers: TypeAlias = Literal[
     "zalando_android_mobile",
     "nike_ios_mobile",
     "nike_android_mobile",
+    "cloudscraper",
     "mms_ios",
+    "mms_ios_1",
     "mms_ios_2",
     "mms_ios_3",
     "mesh_ios",
+    "mesh_ios_1",
     "mesh_ios_2",
     "mesh_android",
+    "mesh_android_1",
     "mesh_android_2",
     "confirmed_ios",
     "confirmed_android",
-    "confirmed_android_2",
-]
+]

python_tls_client-1.0.3.dist-info/METADATA

@@ -1,195 +0,0 @@
-Metadata-Version: 2.4
-Name: python-tls-client
-Version: 1.0.3
-Summary: Advanced Python HTTP Client with TLS fingerprint spoofing (fork with binary-response fix and certificate pinning)
-Author: Emanuele Scarlata
-License-Expression: MIT
-Project-URL: Homepage, https://github.com/Fenix46/Python-Tls-Client
-Project-URL: Source, https://github.com/Fenix46/Python-Tls-Client
-Project-URL: Original, https://github.com/FlorianREGAZ/Python-Tls-Client
-Classifier: Environment :: Web Environment
-Classifier: Intended Audience :: Developers
-Classifier: Natural Language :: English
-Classifier: Operating System :: Unix
-Classifier: Operating System :: MacOS :: MacOS X
-Classifier: Operating System :: Microsoft :: Windows
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Topic :: Internet :: WWW/HTTP
-Classifier: Topic :: Software Development :: Libraries
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: typing-extensions
-Dynamic: license-file
-
-# Python-TLS-Client
-
-> **Nota:** questo è un fork di [Python-Tls-Client](https://github.com/FlorianREGAZ/Python-Tls-Client)
-> di Florian Zager, pubblicato su PyPI con nome diverso (`python-tls-client`) perché
-> il nome originale `tls-client` è già occupato dal progetto upstream.
-> Il modulo importabile resta invariato: `import tls_client`.
->
-> Modifiche rispetto all'originale:
-> - Fix corruzione risposte binarie (protobuf, immagini, ...) — vedi Changelog 1.0.2
-> - Certificate pinning (vedi Changelog 1.0.1)
-
-Python-TLS-Client is an advanced HTTP library based on requests and tls-client.
-
-# Installation
-```
-pip install python-tls-client
-```
-
-# Examples
-The syntax is inspired by [requests](https://github.com/psf/requests), so its very similar and there are only very few things that are different.
-
-Example 1 - Preset:
-```python
-import tls_client
-
-# You can also use the following as `client_identifier`:
-# Chrome --> chrome_103, chrome_104, chrome_105, chrome_106, chrome_107, chrome_108, chrome109, Chrome110,
-#            chrome111, chrome112, chrome_116_PSK, chrome_116_PSK_PQ, chrome_117, chrome_120
-# Firefox --> firefox_102, firefox_104, firefox108, Firefox110, firefox_117, firefox_120
-# Opera --> opera_89, opera_90
-# Safari --> safari_15_3, safari_15_6_1, safari_16_0
-# iOS --> safari_ios_15_5, safari_ios_15_6, safari_ios_16_0
-# iPadOS --> safari_ios_15_6
-# Android --> okhttp4_android_7, okhttp4_android_8, okhttp4_android_9, okhttp4_android_10, okhttp4_android_11,
-#             okhttp4_android_12, okhttp4_android_13
-#
-# more client identifiers can be found in settings.py
-
-session = tls_client.Session(
-    client_identifier="chrome112",
-    random_tls_extension_order=True
-)
-
-res = session.get(
-    "https://www.example.com/",
-    headers={
-        "key1": "value1",
-    },
-    proxy="http://user:password@host:port"
-)
-```
-
-Example 2 - Custom:
-```python
-import tls_client
-
-session = tls_client.Session(
-    ja3_string="771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0",
-    h2_settings={
-        "HEADER_TABLE_SIZE": 65536,
-        "MAX_CONCURRENT_STREAMS": 1000,
-        "INITIAL_WINDOW_SIZE": 6291456,
-        "MAX_HEADER_LIST_SIZE": 262144
-    },
-    h2_settings_order=[
-        "HEADER_TABLE_SIZE",
-        "MAX_CONCURRENT_STREAMS",
-        "INITIAL_WINDOW_SIZE",
-        "MAX_HEADER_LIST_SIZE"
-    ],
-    supported_signature_algorithms=[
-        "ECDSAWithP256AndSHA256",
-        "PSSWithSHA256",
-        "PKCS1WithSHA256",
-        "ECDSAWithP384AndSHA384",
-        "PSSWithSHA384",
-        "PKCS1WithSHA384",
-        "PSSWithSHA512",
-        "PKCS1WithSHA512",
-    ],
-    supported_versions=["GREASE", "1.3", "1.2"],
-    key_share_curves=["GREASE", "X25519"],
-    cert_compression_algo="brotli",
-    pseudo_header_order=[
-        ":method",
-        ":authority",
-        ":scheme",
-        ":path"
-    ],
-    connection_flow=15663105,
-    header_order=[
-        "accept",
-        "user-agent",
-        "accept-encoding",
-        "accept-language"
-    ]
-)
-
-res = session.post(
-    "https://www.example.com/",
-    headers={
-        "key1": "value1",
-    },
-    json={
-        "key1": "key2"
-    }
-)
-```
-
-# Pyinstaller / Pyarmor
-**If you want to pack the library with Pyinstaller or Pyarmor, make sure to add this to your command:**
-
-Linux - Ubuntu / x86:
-```
---add-binary '{path_to_library}/tls_client/dependencies/tls-client-x86.so:tls_client/dependencies'
-```
-
-Linux Alpine / AMD64:
-```
---add-binary '{path_to_library}/tls_client/dependencies/tls-client-amd64.so:tls_client/dependencies'
-```
-
-MacOS M1 and older:
-```
---add-binary '{path_to_library}/tls_client/dependencies/tls-client-x86.dylib:tls_client/dependencies'
-```
-
-MacOS M2:
-```
---add-binary '{path_to_library}/tls_client/dependencies/tls-client-arm64.dylib:tls_client/dependencies'
-```
-
-Windows:
-```
---add-binary '{path_to_library}/tls_client/dependencies/tls-client-64.dll;tls_client/dependencies'
-```
-
-# Acknowledgements
-Big shout out to [Bogdanfinn](https://github.com/bogdanfinn) for open sourcing his [tls-client](https://github.com/bogdanfinn/tls-client) in Golang.
-Also I wanted to keep the syntax as similar as possible to [requests](https://github.com/psf/requests), as most people use it and are familiar with it!
-
-# Changelog
-
-## 1.0.3
-- **Fix**: on Linux, 64-bit x86 machines (`platform.machine() == "x86_64"`) were
-  incorrectly matched by the `"x86" in machine()` check in `cffi.py` and loaded
-  the 32-bit `tls-client-x86.so` binary instead of the 64-bit
-  `tls-client-amd64.so`, causing the native library to fail to load on the vast
-  majority of Linux hosts. `machine()` is now matched explicitly against
-  `x86_64`/`amd64`/`AMD64` before falling back to the 32-bit binary.
-
-## 1.0.2
-- **Fix**: binary response bodies (protobuf, images, ...) were corrupted by a
-  UTF-8 `byteReplacer` (U+FFFD) inside the Go C library. Every byte > 127 that
-  did not form a valid UTF-8 sequence was replaced by `EF BF BD`.
-  - `sessions.py`: now sends `isByteResponse: True` in the request payload so
-    the backend returns the body as a base64 data-URI.
-  - `response.py`: `build_response` decodes the data-URI back to raw bytes for
-    `Response.content`; `Response.text` is a UTF-8 view (with replacement
-    chars for invalid sequences).
-- Added `tests/test_binary_response.py` (regression suite, needs network).
-
-## 1.0.1
-- Certificate pinning

python_tls_client-1.0.3.dist-info/RECORD

@@ -1,22 +0,0 @@
-python_tls_client-1.0.3.dist-info/licenses/LICENSE,sha256=issbIg7ujiqhtvXsx5mmKhdeZ6zd39ew_nEzvvwImfw,1123
-tls_client/__init__.py,sha256=ORP-QdcnLxOEs42G3yPr6txUxryz7jUOA_AtHMafpf8,655
-tls_client/__version__.py,sha256=44prGvLt4nYxvVWOCD33Ky2Zb-QVa7TxgYWnW86DWvU,445
-tls_client/cffi.py,sha256=p6arENyBf1-x43CPOsKAT0ADhy2CaAFAEXdyLj2duzs,1018
-tls_client/cookies.py,sha256=5ujSFL6V8bDMCH8Mow6qoj5dP5GjfMJTd8_jWottvpM,15153
-tls_client/exceptions.py,sha256=edxP4P0NVOK-1r0zNRAMt4yh97LArXz8i6SU9oTSYQY,78
-tls_client/response.py,sha256=5Ji09s3fnrSst3N5n61fJ7motHNF3Jjsk6WBmsZ6iOk,3126
-tls_client/sessions.py,sha256=Uwx4YlhwmUkJonuqu6t0rtINiEpxbwPHbuJ4R2fc3Jw,18651
-tls_client/settings.py,sha256=sknNBPsNOujgIDO5Jo4L8RZFaY6gtGuWUvpJkJ0rBog,1289
-tls_client/structures.py,sha256=zb1wflxxWoKFqe8NMT2qEvIh7RA-kN459ZcNhW8p_Uo,2443
-tls_client/dependencies/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-tls_client/dependencies/tls-client-32.dll,sha256=RYiPCa-Df2FRn1E5A-hqFs-vgkKNq-HyI5BrBZjgj7Q,16512055
-tls_client/dependencies/tls-client-64.dll,sha256=sXd3hlZFX2uEghVCONMjo95NdPKot6Yr2XMlGiWe24c,18685673
-tls_client/dependencies/tls-client-amd64.so,sha256=atLDjHTHV_REcR4XfmtzjeffRnObntzoPzV2GudSJCg,12091312
-tls_client/dependencies/tls-client-arm64.dylib,sha256=9aKdKT0X97KOrXIyi2ilnGDpyi1iIBE8QFaWqxHf8to,10778130
-tls_client/dependencies/tls-client-arm64.so,sha256=MCwijkBgGDvxs9KPpSU53zou73NxzXjmUiZMZwUTpFE,11116584
-tls_client/dependencies/tls-client-x86.dylib,sha256=dEzNbwEuzbc_CWkBW3NyqhBOQY4IJJSMUT_2h5z8LBk,11687888
-tls_client/dependencies/tls-client-x86.so,sha256=xY-FoLKXMRxEJHyb9W1TKXVmuARnSeQw4T8w6cbuHLI,12045392
-python_tls_client-1.0.3.dist-info/METADATA,sha256=ouTIRQ4XKfhMjoplf8POykNnVou4jG5RnLCAsjhjlWA,6784
-python_tls_client-1.0.3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-python_tls_client-1.0.3.dist-info/top_level.txt,sha256=yLrfQtbTRfECzPN62knWdGNmbhcPRev1grCAMuEsEz0,11
-python_tls_client-1.0.3.dist-info/RECORD,,