{"action":"created","issue":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/2600","labels_url":"https://api.github.com/repos/kennethreitz/requests/issues/2600/labels{/name}","comments_url":"https://api.github.com/repos/kennethreitz/requests/issues/2600/comments","events_url":"https://api.github.com/repos/kennethreitz/requests/issues/2600/events","html_url":"https://github.com/kennethreitz/requests/issues/2600","id":76221981,"number":2600,"title":"requests silently sends second request and drops first response (auth in use)","user":{"login":"sawall","id":656957,"avatar_url":"https://avatars.githubusercontent.com/u/656957?v=3","gravatar_id":"","url":"https://api.github.com/users/sawall","html_url":"https://github.com/sawall","followers_url":"https://api.github.com/users/sawall/followers","following_url":"https://api.github.com/users/sawall/following{/other_user}","gists_url":"https://api.github.com/users/sawall/gists{/gist_id}","starred_url":"https://api.github.com/users/sawall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sawall/subscriptions","organizations_url":"https://api.github.com/users/sawall/orgs","repos_url":"https://api.github.com/users/sawall/repos","events_url":"https://api.github.com/users/sawall/events{/privacy}","received_events_url":"https://api.github.com/users/sawall/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-14T04:08:07Z","updated_at":"2015-05-14T05:10:03Z","closed_at":null,"body":"= short version =\r\n\r\nWhen I am using a param and auth with `requests.get()`, `requests` appears to send a second request silently that's missing the param and then shows me the second response when i look at `response.text`.\r\n\r\n= long version, with example and dumps =\r\n\r\nI've been using requests to play a game. One level involved adding a param to a GET request in order to see hidden content on the webpage. This works fine with curl:\r\n\r\n`curl --user natas22:chG9fbe1Tq2eWVMgjYYD1MsfIvN461kJ \"http://natas22.natas.labs.overthewire.org/?revelio\"`\r\n\r\nStrangely, when I try something similar in requests I don't see the same response html text:\r\n\r\n```\r\nauth = ('natas22', 'chG9fbe1Tq2eWVMgjYYD1MsfIvN461kJ')\r\nsite = 'http://natas22.natas.labs.overthewire.org/?revelio'\r\nr=requests.get(site,auth=auth)\r\nr.text\r\n```\r\n\r\nAfter scanning with tcpdump, it appears that requests is getting the correct response, but then it interacts with the server a second time for some reason. During that second interaction requests fails to send the URL param.\r\n\r\nInitial request:\r\n```\r\n22:59:10.459925 IP (tos 0x0, ttl 64, id 27245, offset 0, flags [DF], proto TCP (6), length 331)\r\n    XXXXXX.58647 > melinda.labs.overthewire.org.http: Flags [P.], cksum 0x6cdb (correct), seq 1:280, ack 1, win 4117, options [nop,nop,TS val 377042043 ecr 980610639], length 279\r\n..{...|.......E..Kjm@.@......o.O.....P_.).3.......l......\r\n.y4{:r.OGET /?revelio HTTP/1.1\r\nHost: natas22.natas.labs.overthewire.org\r\nConnection: keep-alive\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nAuthorization: Basic bmF0YXMyMjpjaEc5ZmJlMVRxMmVXVk1nallZRDFNc2ZJdk40NjFrSg==\r\nUser-Agent: python-requests/2.7.0 CPython/2.7.9 Darwin/14.3.0\r\n```\r\n\r\nInitial successful response that I never see from the interpreter:\r\n\r\n```\r\n22:59:10.579617 IP (tos 0x0, ttl 53, id 61399, offset 0, flags [DF], proto TCP (6), length 1500)\r\n    melinda.labs.overthewire.org.http > XXXXXX.58647: Flags [.], cksum 0xed92 (correct), seq 1:1449, ack 280, win 235, options [nop,nop,TS val 980610675 ecr 377042043], length 1448\r\n|.......{.....E.....@.5.T..O.....o.P..3..._.+............\r\n:r.s.y4{HTTP/1.1 302 Found\r\nDate: Thu, 14 May 2015 03:59:10 GMT\r\nServer: Apache/2.4.7 (Ubuntu)\r\nX-Powered-By: PHP/5.5.9-1ubuntu4.9\r\nSet-Cookie: PHPSESSID=p6ls9fd6jqaveoha3vc4kav7g0; path=/; HttpOnly\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: /\r\nContent-Length: 1049\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n<html>\r\n\r\n[html page that I want]\r\n```\r\n\r\nUnlike curl, after this `requests` immediately sends some traffic back for reasons that are unclear to me. Note the `r.sGET / HTTP/1.1` line is missing the revelio param:\r\n\r\n```\r\n22:59:10.579704 IP (tos 0x0, ttl 64, id 53914, offset 0, flags [DF], proto TCP (6), length 52)\r\n    XXXXXX.58647 > melinda.labs.overthewire.org.http: Flags [.], cksum 0x4bc7 (correct), seq 280, ack 1497, win 4071, options [nop,nop,TS val 377042162 ecr 980610675], length 0\r\n..{...|.......E..4..@.@.l....o.O.....P_.+.3.......K......\r\n.y4.:r.s\r\n22:59:10.584887 IP (tos 0x0, ttl 64, id 54853, offset 0, flags [DF], proto TCP (6), length 369)\r\n    XXXXXX.58647 > melinda.labs.overthewire.org.http: Flags [P.], cksum 0x2c85 (correct), seq 280:597, ack 1497, win 4096, options [nop,nop,TS val 377042167 ecr 980610675], length 317\r\n..{...|.......E..q.E@.@.g....o.O.....P_.+.3.......,......\r\n.y4.:r.sGET / HTTP/1.1\r\nHost: natas22.natas.labs.overthewire.org\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nUser-Agent: python-requests/2.7.0 CPython/2.7.9 Darwin/14.3.0\r\nConnection: keep-alive\r\nCookie: PHPSESSID=p6ls9fd6jqaveoha3vc4kav7g0\r\nAuthorization: Basic bmF0YXMyMjpjaEc5ZmJlMVRxMmVXVk1nallZRDFNc2ZJdk40NjFrSg==\r\n```\r\n\r\nThe server then responds with a gzipped version of the page, which is what ends up being what requests shows me when I type `r.text`:\r\n\r\n```\r\n22:59:10.707316 IP (tos 0x0, ttl 53, id 61401, offset 0, flags [DF], proto TCP (6), length 843)\r\n    melinda.labs.overthewire.org.http > XXXXXX.58647: Flags [P.], cksum 0x8233 (correct), seq 1497:2288, ack 597, win 243, options [nop,nop,TS val 980610713 ecr 377042167], length 791\r\n|.......{.....E..K..@.5.Wr.O.....o.P..3..._.,>.....3.....\r\n:r...y4.HTTP/1.1 200 OK\r\nDate: Thu, 14 May 2015 03:59:10 GMT\r\nServer: Apache/2.4.7 (Ubuntu)\r\nX-Powered-By: PHP/5.5.9-1ubuntu4.9\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 383\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n```\r\n\r\nWhy is `requests` making this second request and dropping the param on the floor?"},"comment":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/comments/101915056","html_url":"https://github.com/kennethreitz/requests/issues/2600#issuecomment-101915056","issue_url":"https://api.github.com/repos/kennethreitz/requests/issues/2600","id":101915056,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2015-05-14T05:10:03Z","updated_at":"2015-05-14T05:10:03Z","body":"Because we got redirected. =)\r\n\r\nThe first response is a HTTP 302. Per RFC 7231, we follow that redirect, making another request with the URL set to the value of the 'Location' header on the 302. By default curl does not follow redirects: by default we do. To get curl to do what we do, pass it the `-L` command line flag. To get us to behave like curl, set `allow_redirects=False` in your call to `requests.get`."}}