Default ssl contexts per http versions.

Author: T-256

httpx/_config.py

@@ -46,6 +46,7 @@ class UnsetType:
 
 
 class SSLContext(ssl.SSLContext):
+    _default_contexts: dict[tuple[bool, bool], "SSLContext"] = {}
     DEFAULT_CA_BUNDLE_PATH = Path(certifi.where())
 
     def __init__(
@@ -128,6 +129,24 @@ def _load_client_certs(self, cert: typing.Optional[CertTypes] = None) -> None:
                     password=cert[2],
                 )
 
+    @classmethod
+    def from_defaults(cls, http1: bool = True, http2: bool = False) -> "SSLContext":
+        context = cls._default_contexts.get((http1, http2))
+        if context is not None:
+            return context
+
+        context = SSLContext()
+        if ssl.HAS_ALPN:
+            alpn_idents = []
+            if http1:
+                alpn_idents.append("http/1.1")
+            if http2:
+                alpn_idents.append("h2")
+            context.set_alpn_protocols(alpn_idents)
+
+        cls._default_contexts[(http1, http2)] = context
+        return context
+
     def __repr__(self) -> str:
         class_name = self.__class__.__name__
 

httpx/_transports/default.py

@@ -137,7 +137,7 @@ def __init__(
         socket_options: typing.Iterable[SOCKET_OPTION] | None = None,
     ) -> None:
         proxy = Proxy(url=proxy) if isinstance(proxy, (str, URL)) else proxy
-        ssl_context = ssl_context or SSLContext()
+        ssl_context = ssl_context or SSLContext.from_defaults(http1=http1, http2=http2)
 
         if proxy is None:
             self._pool = httpcore.ConnectionPool(
@@ -276,7 +276,7 @@ def __init__(
         socket_options: typing.Iterable[SOCKET_OPTION] | None = None,
     ) -> None:
         proxy = Proxy(url=proxy) if isinstance(proxy, (str, URL)) else proxy
-        ssl_context = ssl_context or SSLContext()
+        ssl_context = ssl_context or SSLContext.from_defaults(http1=http1, http2=http2)
 
         if proxy is None:
             self._pool = httpcore.AsyncConnectionPool(

tests/test_utils.py

@@ -121,8 +121,7 @@ def test_logging_redirect_chain(server, caplog):
 
 def test_logging_ssl(caplog):
     caplog.set_level(logging.DEBUG)
-    with httpx.Client():
-        pass
+    _context = httpx.SSLContext()
 
     cafile = certifi.where()
     assert caplog.record_tuples == [