fasthttpc

English | Türkçe

A pure-Python HTTP client with its own TLS 1.3 / TLS 1.2 stack, browser TLS and HTTP/2 fingerprint impersonation (Chrome, Firefox, Safari), HTTP/2 multiplexing, and a synchronous and an asyncio API. No C extension of its own: the only compiled dependency is cryptography for primitives (AEAD, X25519, certificate parsing).

Status: experimental (alpha). The TLS stack is written from scratch and has not been independently security-audited. For critical production traffic prefer a mature client such as curl_cffi, httpx or requests. See Security model and Known limits.

Install

pip install fasthttpc
pip install "fasthttpc[brotli,zstd]"   # optional content decoders

Python 3.10 - 3.13 on Linux, macOS and Windows.

Quick start

from fasthttpc import Session

with Session(impersonate="chrome_131") as s:
    r = s.get("https://httpbin.org/get")
    print(r.status_code, r.elapsed)
    print(r.json())

Async:

import asyncio
from fasthttpc import AsyncSession

async def main():
    async with AsyncSession(impersonate="chrome_131") as s:
        rs = await asyncio.gather(*(s.get(f"https://httpbin.org/anything/{i}") for i in range(5)))
        print([r.status_code for r in rs])

asyncio.run(main())

Offline testing:

from fasthttpc import Session, Response, MockTransport

transport = MockTransport(lambda request: Response(200, body=b'{"ok": true}',
                                                   headers={"Content-Type": "application/json"}))
with Session(transport=transport) as s:
    assert s.get("https://api.example.com/").json() == {"ok": True}

Features

How it compares

Honest comparison; "maturity" matters as much as features here.

Choose fasthttpc if you want a dependency-light, readable, inspectable client whose TLS fingerprint you can control precisely, or you cannot ship C extensions. Choose curl_cffi if you need the widest and most up-to-date fingerprint coverage or maximum performance. Choose requests/httpx when you do not need impersonation.

Security model

Every TLS 1.3 connection authenticates the server with three independent checks, all mandatory:

Trust anchors are the certifi bundle plus the system store, or exactly the PEM file you pass as verify="ca.pem". verify=False is not supported and raises ValueError; pass the CA (or the self-signed certificate) you want to trust instead. TLS 1.2 additionally enforces Extended Master Secret, renegotiation_info, DOWNGRD sentinel detection and rejects CBC, static RSA, DHE and SHA-1 signatures.

What this does not give you: an independent audit, constant-time guarantees beyond what cryptography provides, or protection from implementation bugs in a young protocol stack. Report vulnerabilities privately via GitHub security advisories.

Known limits

• No session resumption (PSK) and no 0-RTT: every connection does a full handshake.
• No post-quantum / hybrid key shares (X25519MLKEM768), no secp521r1/ffdhe.
• TLS 1.2: only ECDHE + AES-GCM / ChaCha20-Poly1305; CBC and older suites are rejected with an explicit error.
• HPACK Huffman encoding is not implemented (decoding is); this causes a tiny HTTP/2 fingerprint deviation.
• HTTP/2 server push is a protocol error (ENABLE_PUSH=0); PRIORITY is not sent.
• Session is not thread-safe: use one per thread.
• Timeout.write is not enforced separately on the sync side.
• Only 3 browser families are modelled; profiles are snapshots and age.
• Pure-Python crypto framing is slower than OpenSSL for large bulk transfers.

The full, detailed list is in README.tr.md and the documentation.

Documentation

Quick start, async usage, profiles, proxies, TLS, HTTP/2, testing, migration guides and the API reference live at https://bu-ra34.github.io/fasthttpc/ (sources in docs/).

Development

git clone https://github.com/bu-ra34/fasthttpc && cd fasthttpc
pip install -e ".[dev]"
pytest            # offline unit tests
ruff check .
mypy
mkdocs serve      # needs: pip install -e ".[docs]"

License

MIT. See LICENSE.