`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Bug report

(Copied from the private security issue)

Bug description:

Summary

urllib.request.HTTPPasswordMgr ignores http:// and https:// when matching
saved passwords. A password saved for an HTTPS URL can be sent over unencrypted HTTP.

Details

HTTPPasswordMgr.reduce_uri(self, uri, default_port=True) in Lib/urllib/request.py drops the scheme, and the password manager calls it with both default_port=True and default_port=False. With default_port=False, https://example.com and http://example.com are reduced to the same name/path, so there's an incorrect match.

This conflicts with RFC 9110 section 11.5, which defines a "protection space" using the origin and the realm. The origin includes the scheme.

RFC 7617 section 2.2 also gives HTTP and HTTPS URLs as examples of different Basic authentication
scopes.

PoC

This script saves a password for an HTTPS URL, then shows that the handler adds it to a matching HTTP request.

from base64 import b64decode
from urllib.request import HTTPBasicAuthHandler, HTTPPasswordMgrWithPriorAuth, Request

passwords = HTTPPasswordMgrWithPriorAuth()
passwords.add_password(
    None, "https://example.com/", "alice", "secret", is_authenticated=True
)
request = Request("http://example.com/")
HTTPBasicAuthHandler(passwords).http_request(request)

header = request.get_header("Authorization")
if header:
    print("Vulnerable:", b64decode(header.split()[1]).decode())
else:
    print("Not vulnerable")

is_authenticated=True makes the handler add the password before contacting a server, so the PoC does not need a running web server.

Current output:

Vulnerable: alice:secret

Needs to be fixed in: main, 3.15, 3.14, 3.13, 3.12, 3.11, and 3.10

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-155696
• gh-155968
• gh-155969
• gh-155970
• gh-155971
• gh-155972
• gh-155973

Start in Lib/urllib/request.py with HTTPPasswordMgr.reduce_uri and the HTTP password-matching flow. Run the provided HTTPPasswordMgrWithPriorAuth proof of concept, then verify the behavior across the listed Python versions and relevant tests. Done means HTTPS credentials are not added to the matching HTTP request, with the existing authentication behavior preserved.