URLPattern never matches default ports in proxy keys (NO_PROXY=example.com:80)

[davrens101]

Proxy keys and NO_PROXY entries that spell out a default port never match. NO_PROXY=example.com:80 becomes the key all://example.com:80, and it doesn't match http://example.com.

import httpx
from httpx._utils import URLPattern

print(URLPattern("all://example.com:80").matches(httpx.URL("http://example.com")))    # False, expected True
print(URLPattern("all://example.com:443").matches(httpx.URL("https://example.com")))  # False, expected True

On httpx 0.28.1 and current master (b5addb6), Python 3.12.10, Windows 11.

The cause is that URL drops a port equal to its scheme's default, but only when it knows the scheme. httpx.URL("http://example.com").port is None, while httpx.URL("all://example.com:80").port is 80 because "all" has no default. So the pattern keeps 80, the request URL has None, and the comparison fails. https://example.com:443 works today since the https scheme is known.

I have a small fix in URLPattern: read the port from the raw pattern, and compare it against the request URL after normalizing it for the request's scheme. It comes with 7 added cases in test_url_matches. Is this something you'd take as a PR?

[2SinceJuly]

Confirmed, and your diagnosis is right — but there's a wrinkle in the fix surface that's worth deciding before you write the PR: priority has the same assumption baked in, so a port-normalisation fix in matches alone will reorder which pattern wins.

The mechanism, agreed. URL.__init__ drops a port equal to the scheme's default, but only when the scheme is known. URL("all://example.com:80").port is 80 (no default for all), while URL("http://example.com").port is None. Then matches does a plain self.port != other.port comparison, so 80 != None and the pattern misses. Your two repro lines are exactly this.

The trap. priority (_utils.py, right below matches) is:

port_priority = 0 if self.port is not None else 1

So a pattern that spells out :80 or :443 sorts ahead of the equivalent portless pattern. Proxy sorts patterns by this tuple and takes the first match. That means a pattern with an explicit default port isn't just non-matching today — once it does match, it silently outranks the portless pattern above it. If a user has both all://example.com and all://example.com:443 in NO_PROXY, the ordering of their mounts/no_proxy semantics changes under your fix. That's probably the desired outcome (more specific wins), but it's a behaviour change that should be in the PR description rather than discovered later.

On "read the port from the raw pattern": be careful here. URL.__init__ already normalises the pattern string, so self.pattern retains the raw text but URL(pattern) has already dropped the port if the scheme was known. You need the intended port, which means either:

• parse the port out of the raw pattern text yourself (fragile — pattern can be all://user:pass@host:80/path), or
• keep a self.port_specified flag from the raw text and resolve it against the request's scheme at match time, which is cleaner and lets you express the right semantics: "port 80 stated on an all:// pattern means 80 when the request is http, and is a non-match when the request is https."

The second shape handles a case your description doesn't cover: all://example.com:443 should not match http://example.com (port 80). A naive "normalize both sides" comparison would make 443 from all:// equal None from http:// if you normalise against the wrong scheme, so the scheme has to come from other, not from self.

Concrete suggestion for matches:

if self.port is not None:
    other_port = other.port
    if other_port is None:
        other_port = {"http": 80, "https": 443}.get(other.scheme)
    if self.port != other_port:
        return False

and leave priority alone unless you decide the specificity change is intentional — if you do want it, gate port_priority on the same "port is meaningful for this pattern" notion, otherwise a :80 pattern will keep its elevated rank while matching more URLs than before.

On your test plan: 7 cases in test_url_matches is good, but add these three, which are the ones a reviewer will think of:

1. all://example.com:80 vs https://example.com → False (different default)
2. all://example.com:443 vs http://example.com:443 → True (explicit non-default on the request side)
3. A no_proxy integration case with both example.com and example.com:80 present, asserting the more specific one wins — that's the test that pins the priority decision.

Also worth checking: URLPattern("all://example.com:80") against http://example.com:8080 must stay False; that's the case where over-eager normalisation would break things.

Net: yes, take it as a PR — but scope the description to "default ports in patterns now match, and explicit ports gain the specificity they already claimed in priority", because the second half is a behaviour change the maintainers will want to sign off on explicitly.

[davrens101]

I checked those cases against the local patch, including the public Client mount-selection path. all://example.com:80 does not match HTTPS or HTTP on port 8080; all://example.com:443 does match HTTP explicitly using port 443. A pattern containing userinfo and a path also parses correctly with urlsplit.

The priority tuple is unchanged. Once an explicit default-port pattern can match, it wins over a portless pattern, as you pointed out. The client smoke run selected the explicit :80 mount for HTTP, the explicit :443 mount for HTTPS, and the portless mount for :8080. I’ll make that behavior change explicit in any PR description.

The port comparison uses the request’s scheme. I’m still waiting for a maintainer to confirm the scope before opening a PR.

[davrens101]

I have the branch ready at davrens101:fix/urlpattern-default-ports (commit 4c6ce77) with the port normalisation against other.scheme, the raw pattern port parsing, and the priority test pinning all://example.com:80 ahead of all://example.com.

The repository has an interaction limit active that restricts opening pull requests to collaborators, so GitHub blocks opening a PR directly. The branch and tests are pushed to https://github.com/davrens101/httpx/tree/fix/urlpattern-default-ports if you want to pull from there or open the gate.