timeouts are not set in requests inside a custom authentication flow

[scratchmex]

the problem is that whenever I have a custom authentication that yields some requests, those requests does not have a timeout set. sometimes the underlying authentication flow stalls the whole request.

see the timeout=None here

DEBUG:httpcore.connection:connect_tcp.started host='cloudflare.com' port=80 local_address=None timeout=None 
...
DEBUG:httpcore.connection:connect_tcp.started host='google.com' port=80 local_address=None timeout=5.0 socket_options=None

citing the documentation on timeouts

HTTPX is careful to enforce timeouts everywhere by default.
The default behavior is to raise a TimeoutException after 5 seconds of network inactivity.

I am raising this as suggested by the bug template but I think it's definitely a bug.

I know the underlying problem is caused because the custom auth class is not aware of the underlying client and the request is missing the request.extensions={'timeout': {...}} but this exposes the bigger problem has been raised in #3383 the custom auth class being too decoupled from the client

code example reproducing the issue

import httpx
import logging

logging.basicConfig(level="DEBUG")

class MyAuth(httpx.Auth):
    def auth_flow(self, request):
        yield httpx.Request("get", "http://cloudflare.com")
        yield request

httpx.get("http://google.com", auth=MyAuth())

workaround is to copy original extensions which was build by the client httpx.Request(..., extensions=request.extensions)

full log

DEBUG:httpcore.connection:connect_tcp.started host='cloudflare.com' port=80 local_address=None timeout=None socket_options=None
DEBUG:httpcore.connection:connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x79dea4cdd940>
DEBUG:httpcore.http11:send_request_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_headers.complete
DEBUG:httpcore.http11:send_request_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_body.complete
DEBUG:httpcore.http11:receive_response_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_headers.complete return_value=(b'HTTP/1.1', 301, b'Moved Permanently', [(b'Date', b'Mon, 06 Oct 2025 04:50:50 GMT'), (b'Content-Type', b'text/html'), (b'Content-Length', b'167'), (b'Connection', b'keep-alive'), (b'Cache-Control', b'max-age=3600'), (b'Expires', b'Mon, 06 Oct 2025 05:50:50 GMT'), (b'Location', b'https://www.cloudflare.com/'), (b'Set-Cookie', b'__cf_bm=4xYdk4NW3N3IMFWIR_k9jZvAxRVvjpdd3aIv4DVXOZA-1759726250-1.0.1.1-Fn4Nfh48YCAwhfNT4IOSkYbPmBrZfIO8CcJRj0X_zc8s497vXfEzPDlsR9ZSXsTd1J8CYkC59ke8gmch6pxUOoz3eT91CqCX6zd1qrOFq8Y; path=/; expires=Mon, 06-Oct-25 05:20:50 GMT; domain=.cloudflare.com; HttpOnly'), (b'Report-To', b'{"endpoints":[{"url":"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=n6HJFvQT21pMHfW%2F0zAOfA50FMnyOKcyrwSusP66uhG6LKQy%2FyYzX0f4ZuB5Yf%2F%2BsYfoCE0aupF3Ve4KFGE7zBYmqQyrkR%2BFQshcZ830fbnSclvy%2B%2B0%2FqrDkAF%2BbtG34"}],"group":"cf-nel","max_age":604800}'), (b'NEL', b'{"success_fraction":0,"report_to":"cf-nel","max_age":604800}'), (b'Server', b'cloudflare'), (b'CF-RAY', b'98a28a499bc56dba-QRO'), (b'alt-svc', b'h3=":443"; ma=86400')])
INFO:httpx:HTTP Request: GET http://cloudflare.com "HTTP/1.1 301 Moved Permanently"
DEBUG:httpcore.http11:receive_response_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_body.complete
DEBUG:httpcore.http11:response_closed.started
DEBUG:httpcore.http11:response_closed.complete
DEBUG:httpcore.connection:connect_tcp.started host='google.com' port=80 local_address=None timeout=5.0 socket_options=None
DEBUG:httpcore.connection:connect_tcp.complete return_value=<httpcore._backends.sync.SyncStream object at 0x79dea4c5b250>
DEBUG:httpcore.http11:send_request_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_headers.complete
DEBUG:httpcore.http11:send_request_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:send_request_body.complete
DEBUG:httpcore.http11:receive_response_headers.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_headers.complete return_value=(b'HTTP/1.1', 301, b'Moved Permanently', [(b'Location', b'http://www.google.com/'), (b'Content-Type', b'text/html; charset=UTF-8'), (b'Content-Security-Policy-Report-Only', b"object-src 'none';base-uri 'self';script-src 'nonce-2GarZFTt_rMr-TCahSe9xQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp"), (b'Date', b'Mon, 06 Oct 2025 04:50:50 GMT'), (b'Expires', b'Wed, 05 Nov 2025 04:50:50 GMT'), (b'Cache-Control', b'public, max-age=2592000'), (b'Server', b'gws'), (b'Content-Length', b'219'), (b'X-XSS-Protection', b'0'), (b'X-Frame-Options', b'SAMEORIGIN')])
INFO:httpx:HTTP Request: GET http://google.com "HTTP/1.1 301 Moved Permanently"
DEBUG:httpcore.http11:receive_response_body.started request=<Request [b'GET']>
DEBUG:httpcore.http11:receive_response_body.complete
DEBUG:httpcore.http11:response_closed.started
DEBUG:httpcore.http11:response_closed.complete
DEBUG:httpcore.connection:close.started
DEBUG:httpcore.connection:close.complete
DEBUG:httpcore.connection:close.started
DEBUG:httpcore.connection:close.complete