Every Python installation ships with a working HTTP stack. Most developers never touch it, running pip install requests before writing a single line of network code.
That habit has a cost. When a connection hangs for 30 seconds, or a proxy returns a 407 and the traceback points somewhere deep inside a dependency, the fix usually lives in the standard library modules underneath.
Knowing what’s already in the box makes debugging faster and dependency trees shorter.
The Three Layers Underneath
Python’s networking support stacks in tiers, and each tier hides the one below it. At the bottom sits socket, a thin wrapper over the operating system’s BSD socket API that moves bytes across TCP and knows nothing about HTTP itself.
One level up, http.client turns those bytes into structured requests and responses. It parses status lines, stores headers in an email.message.Message object (a quirk inherited from Python 2 that still catches people off guard), and returns file-like response objects that get read manually.
That split matters in practice. http.client hands over control of each individual connection, while urllib.request trades some of that control for convenience: redirect following, proxy detection from environment variables, and basic authentication all come included.
urllib.request sits on top of both, wrapping the whole connection lifecycle in a single urlopen() call. Benchmarks comparing python http.client against Requests, httpx, and aiohttp put the performance gap far closer than most teams assume, particularly for plain GET traffic at moderate volume.
What http.client Handles Well
HTTPSConnection keeps a socket open across requests, which matters when a script hits the same host 500 times in a row. Reusing that connection (HTTP persistent connections, in spec language) skips the TLS handshake on every call after the first, and the handshake is often the most expensive part of a short request.
The module also covers chunked transfer encoding, the Expect: 100-continue flow, and custom ssl.SSLContext objects for certificate pinning or client certificates. HTTP/2 isn’t included, though. Multiplexing still requires an outside library such as httpx or hyper.
Response handling stays deliberately low level. A response object exposes status, reason, read(), and getheaders(), so decoding JSON means running the bytes through json.loads() manually. Two extra lines of code, in exchange for full visibility into what came back over the wire.
Timeouts deserve attention here. Pass one to the constructor, or the underlying socket blocks indefinitely, which is how batch jobs end up frozen at 3 a.m. with no error message at all.
Proxies, Cookies, and Opener Chains
urllib.request configures proxies through handler objects instead of a keyword argument. Build a ProxyHandler with a protocol-to-address dictionary, pass it into build_opener(), and every request made through that opener routes accordingly.
Doing the same with http.client means calling set_tunnel() before the request, which issues the CONNECT method defined in RFC 9110. Skip that step and HTTPS traffic fails with a certificate error that points nowhere useful.
urllib.parse covers the unglamorous half of the job: encoding query strings, escaping unsafe characters, and joining a relative path against a base URL without producing something malformed.
Cookies follow the same pattern: attach an http.cookiejar.CookieJar through HTTPCookieProcessor and session state carries across calls. It’s more setup than requests.Session(). But nothing about the process stays hidden, which is exactly the point when a login flow breaks.
The Server Side, and Its Limits
python -m http.server 8000 starts a static file server in one command, no config file required. It’s genuinely handy for previewing a build directory or shifting files between two machines on the same network.
But the warning in the official documentation is worth reading before anything else. The default HTTPServer handles a single request at a time and implements only basic security checks; ThreadingHTTPServer solves the concurrency half and leaves the rest untouched.
Real traffic belongs behind gunicorn, uvicorn, or nginx. The built-in server exists for development and quick transfers, and treating it as anything more invites trouble.
Where This Leaves Things
The standard library won’t replace httpx for async-heavy work, and nobody should hand-roll http.client code for a project that needs retries, pooling, and clean JSON handling from day one.
Every third-party client eventually leaks its plumbing during an outage, though. Developers who’ve spent an afternoon reading raw response objects debug those moments in minutes rather than hours, and these modules aren’t going anywhere: they’ve shipped with every CPython release since Python 3.0.
