To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files https://github.com/p

To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files https://github.com/psf/requests/pull/2936/files The code already had `host = ri.netloc.split(':')[0]` before that. The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone: urllib.parse.urlparse('http://example.com:@evil.com:8080/') ParseResult(scheme='http', netloc='example.com:@evil.com:8080', path='/', params='', query='', fragment='') Compare this with php: parse_url ('http://example.com:@evil.com:8080/') [ "scheme" => "http", "host" => "evil.com", "port" => 8080, "user" => "example.com", "pass" => "", "path" => "/", ]