timeouts are not set in requests inside a custom authentication flow

[scratchmex]

the problem is that whenever I have a custom authentication that yields some requests, those requests does not have a timeout set. sometimes the underlying authentication flow stalls the whole request.

see the timeout=None here

DEBUG:httpcore.connection:connect_tcp.started host='cloudflare.com' port=80 local_address=None timeout=None 
...
DEBUG:httpcore.connection:connect_tcp.started host='google.com' port=80 local_address=None timeout=5.0 socket_options=None

citing the documentation on timeouts

HTTPX is careful to enforce timeouts everywhere by default.
The default behavior is to raise a TimeoutException after 5 seconds of network inactivity.

I am raising this as suggested by the bug template but I think it's definitely a bug.

I know the underlying problem is caused because the custom auth class is not aware of the underlying client and the request is missing the request.extensions={'timeout': {...}} but this exposes the bigger problem has been raised in https://github.com/encode/httpx/issues/3383 the custom auth class being too decoupled from the client

code example reproducing the issue

import httpx
import logging

logging.basicConfig(level="DEBUG")

class MyAuth(httpx.Auth):
    def auth_flow(self, request):
        yield httpx.Request("get", "http://cloudflare.com")
        yield request

httpx.get("http://google.com", auth=MyAuth())

workaround is to copy original extensions which was build by the client httpx.Request(..., extensions=request.extensions)

full log

DEBUG:httpcore.connection:connect_tcp.started host='cloudflare.com' port=80 local_address=None timeout=None socket_options=None
DEBUG:httpcore.connection:connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x79dea4cdd940>
DEBUG:httpcore.http11:send_request_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_headers.complete
DEBUG:httpcore.http11:send_request_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_body.complete
DEBUG:httpcore.http11:receive_response_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_headers.complete return_value=(b'HTTP/1.1', 301, b'Moved Permanently', [(b'Date', b'Mon, 06 Oct 2025 04:50:50 GMT'), (b'Content-Type', b'text/html'), (b'Content-Length', b'167'), (b'Connection', b'keep-alive'), (b'Cache-Control', b'max-age=3600'), (b'Expires', b'Mon, 06 Oct 2025 05:50:50 GMT'), (b'Location', b'https://www.cloudflare.com/'), (b'Set-Cookie', b'__cf_bm=4xYdk4NW3N3IMFWIR_k9jZvAxRVvjpdd3aIv4DVXOZA-1759726250-1.0.1.1-Fn4Nfh48YCAwhfNT4IOSkYbPmBrZfIO8CcJRj0X_zc8s497vXfEzPDlsR9ZSXsTd1J8CYkC59ke8gmch6pxUOoz3eT91CqCX6zd1qrOFq8Y; path=/; expires=Mon, 06-Oct-25 05:20:50 GMT; domain=.cloudflare.com; HttpOnly'), (b'Report-To', b'{"endpoints":[{"url":"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=n6HJFvQT21pMHfW%2F0zAOfA50FMnyOKcyrwSusP66uhG6LKQy%2FyYzX0f4ZuB5Yf%2F%2BsYfoCE0aupF3Ve4KFGE7zBYmqQyrkR%2BFQshcZ830fbnSclvy%2B%2B0%2FqrDkAF%2BbtG34"}],"group":"cf-nel","max_age":604800}'), (b'NEL', b'{"success_fraction":0,"report_to":"cf-nel","max_age":604800}'), (b'Server', b'cloudflare'), (b'CF-RAY', b'98a28a499bc56dba-QRO'), (b'alt-svc', b'h3=":443"; ma=86400')])
INFO:httpx:HTTP Request: GET http://cloudflare.com "HTTP/1.1 301 Moved Permanently"
DEBUG:httpcore.http11:receive_response_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_body.complete
DEBUG:httpcore.http11:response_closed.started
DEBUG:httpcore.http11:response_closed.complete
DEBUG:httpcore.connection:connect_tcp.started host='google.com' port=80 local_address=None timeout=5.0 socket_options=None
DEBUG:httpcore.connection:connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x79dea4c5b250>
DEBUG:httpcore.http11:send_request_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_headers.complete
DEBUG:httpcore.http11:send_request_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_body.complete
DEBUG:httpcore.http11:receive_response_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_headers.complete return_value=(b'HTTP/1.1', 301, b'Moved Permanently', [(b'Location', b'http://www.google.com/'), (b'Content-Type', b'text/html; charset=UTF-8'), (b'Content-Security-Policy-Report-Only', b"object-src 'none';base-uri 'self';script-src 'nonce-2GarZFTt_rMr-TCahSe9xQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp"), (b'Date', b'Mon, 06 Oct 2025 04:50:50 GMT'), (b'Expires', b'Wed, 05 Nov 2025 04:50:50 GMT'), (b'Cache-Control', b'public, max-age=2592000'), (b'Server', b'gws'), (b'Content-Length', b'219'), (b'X-XSS-Protection', b'0'), (b'X-Frame-Options', b'SAMEORIGIN')])
INFO:httpx:HTTP Request: GET http://google.com "HTTP/1.1 301 Moved Permanently"
DEBUG:httpcore.http11:receive_response_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_body.complete
DEBUG:httpcore.http11:response_closed.started
DEBUG:httpcore.http11:response_closed.complete
DEBUG:httpcore.connection:close.started
DEBUG:httpcore.connection:close.complete
DEBUG:httpcore.connection:close.started
DEBUG:httpcore.connection:close.complete

[amasen02]

You've hit on an important architectural nuance between httpx and httpcore.

Why this happens

In HTTPX, timeouts are communicated to the transport layer via the extensions dictionary on the Request object:

request.extensions["timeout"] = {
    "connect": 5.0,
    "read": 5.0,
    "write": 5.0,
    "pool": 5.0
}

When you call client.get(...) or client.send(request), the Client takes its configured self.timeout and populates request.extensions["timeout"] before dispatching the request.

However, when an httpx.Auth flow yields a freshly created httpx.Request(...), that new object initializes with extensions={}. When the underlying httpcore transport executes it, request.extensions.get("timeout") is empty, so httpcore defaults to timeout=None (an unbounded, infinite timeout). If the auth server stalls or drops packets, the entire application blocks.

---

Recommended Solutions

1. Inherit the parent request's extensions (Recommended)

The cleanest way to ensure your auth request respects whatever timeout (and trace hooks) the caller configured on the client is to copy request.extensions:

class MyAuth(httpx.Auth):
    def auth_flow(self, request):
        token_request = httpx.Request(
            "POST",
            "https://auth.example.com/token",
            data={"grant_type": "client_credentials"},
            extensions=dict(request.extensions)  # <--- Preserves timeout & trace hooks
        )
        token_response = yield token_request
        token = token_response.json()["access_token"]

        request.headers["Authorization"] = f"Bearer {token}"
        yield request

2. Set an explicit Timeout via Timeout.as_dict()

If your authentication step should enforce its own dedicated timeout (e.g., a tighter 3-second limit):

class MyAuth(httpx.Auth):
    def __init__(self, auth_timeout: float = 3.0):
        self.timeout = httpx.Timeout(auth_timeout)

    def auth_flow(self, request):
        token_request = httpx.Request(
            "POST",
            "https://auth.example.com/token",
            data={"grant_type": "client_credentials"},
            extensions={"timeout": self.timeout.as_dict()}  # <--- Converts Timeout to httpcore dict
        )
        token_response = yield token_request
        # ... apply credentials ...
        yield request

httpx.Timeout.as_dict() produces the exact {'connect': ..., 'read': ..., 'write': ..., 'pool': ...} structure that httpcore consumes.

3. The Dedicated Client Pattern (for complex OAuth2/OIDC)

If your authentication involves token caching, expiry checking, and multi-tenant refresh, holding an internal httpx.Client or using a token manager class allows the auth client to maintain its own connection pool and explicit timeouts independently of caller requests.