Chapter 6 · Sessions and Persistent Connections

Chapter goals: master the Session object and understand connection pooling, cookie persistence, and SSL configuration.

6.1 Session Basics

A Session keeps cookies, connection pools, and configuration across requests:

import requests

# Create a Session
session = requests.Session()

# Set defaults
session.headers.update({
    'User-Agent': 'MyApp/1.0',
    'Accept': 'application/json'
})
session.params = {'api_version': 'v2'}

# All requests reuse the configuration
resp1 = session.get('https://api.example.com/user')
resp2 = session.get('https://api.example.com/posts')
resp3 = session.post('https://api.example.com/login', json={'user': 'admin'})

# Cookies are kept automatically
session.get('https://httpbin.org/cookies/set/session/cookie123')
resp = session.get('https://httpbin.org/cookies')
print(resp.json()['cookies'])  # {'session': 'cookie123'}

# Close when done
session.close()

6.2 Connection Pools and Performance

Sessions maintain a TCP connection pool internally; reusing connections improves performance significantly:

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# Create a Session
session = requests.Session()

# Retry strategy
retry = Retry(
    total=3,              # max retries
    backoff_factor=1,     # retry intervals: 0s, 1s, 2s...
    status_forcelist=[429, 500, 502, 503, 504]  # statuses to retry on
)

# Connection pool configuration
adapter = HTTPAdapter(
    max_retries=retry,
    pool_connections=10,   # pool size
    pool_maxsize=10
)

# Mount onto the Session
session.mount('https://', adapter)
session.mount('http://', adapter)

# All requests now use the configured adapters
resp = session.get('https://httpbin.org/get')

6.3 SSL/TLS Configuration

import requests

# Verify SSL certificates (default: on)
resp = requests.get('https://httpbin.org/get', verify=True)

# Disable verification (debug only; not recommended in production)
resp = requests.get('https://self-signed.badssl.com/', verify=False)

# Use a custom CA bundle
resp = requests.get('https://example.com', verify='/path/to/ca-bundle.crt')

# httpx equivalents
import httpx
client = httpx.Client(verify=False)  # no certificate verification
client = httpx.Client(verify='/path/to/ca.pem')  # custom CA

6.4 Proxy Configuration

import requests

# Global proxies
proxies = {
    'http': 'http://proxy.example.com:8080',
    'https': 'http://proxy.example.com:8080'
}
resp = requests.get('https://example.com', proxies=proxies)

# Bypass proxy for specific hosts
no_proxy = 'localhost,127.0.0.1'
resp = requests.get('https://example.com', proxies=proxies, verify=True)

# Session-level proxy settings
session = requests.Session()
session.proxies = proxies
session.trust_env = False  # ignore environment-variable proxies

6.5 A Complete Session Setup Example

import requests

def create_session():
    session = requests.Session()

    # Default headers
    session.headers.update({
        'User-Agent': 'PythonHTTPCourse/1.0',
        'Accept': 'application/json'
    })

    # Default timeout
    session.timeout = 30

    # Retry configuration
    retry = Retry(total=3, backoff_factor=0.5)
    adapter = HTTPAdapter(max_retries=retry)
    session.mount('https://', adapter)
    session.mount('http://', adapter)

    return session

# Usage
session = create_session()
try:
    resp = session.get('https://api.github.com/user')
    print(resp.json()['login'])
finally:
    session.close()

6.6 Chapter Summary

• Session objects keep cookies, headers, and configuration across requests;
• Connection pools and retry strategies improve performance and reliability;
• SSL verification is on by default — don't turn it off casually in production;
• Proxies can be configured globally or per-request.

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. What is the main advantage of a Session over plain requests?

2. What does the HTTPAdapter max_retries argument configure?

3. What does verify=False do?

4. What does session.trust_env = False do?

🛠️ Hands-On Exercises

1. Create a Session, set a cookie via httpbin, then verify the cookie persists.
2. Configure a retry strategy that automatically retries 5xx responses three times and observe the effect.
3. Access an HTTPS site with a custom CA certificate (self-signed.badssl.com works for testing).