Simple get/post request blocked in python 3 but not in python 2

Question

I'm working on a simple web scraper in python 3 but when I send a get or a post request, the response is 403. In python 2 works fine though. I'm using the same version of requests libraries in both versions. I have also tried with Verify=False/True but the difference in both versions remains.

requests = 2.22.0

certifi = 2019.9.11

from requests import get
url = 'https://www.gamestop.com/'
header = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Encoding': 'gzip, deflate, br',
    'Accept-Language': 'en-US,en;q=0.5',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0',
    'DNT': '1',
    'Upgrade-Insecure-Requests': '1',
    'Connection': 'keep-alive',
    'Host': 'www.gamestop.com'
}
res = get(url, headers=header, verify=False).status_code
print(res)
# 403 when using python 3.7.4
# 200 when using python 2.7.16

Edit by @blhsing:

下面的列表根据注释跟踪哪些特定的Python版本有效，哪些版本失败。到目前为止，跨平台的每个特定Python版本的成功和失败都是一致的。

随意编辑您自己的结果以及用于生成结果的特定Python版本的问题的这一部分。

2.7.14 works (blhsing)
2.7.16 works (repl.it)
3.6.5 works (blhsing)
3.6.8 fails (Reinderien and blhsing)
3.7.3 works (wim and blhsing)
3.7.4 fails (repl.it and blhsing)
3.8.0 fails (OP)

关于repl.it的演示：Python 2.7.16和Python 3.7.4

Answer 1

这是urlib3引发的异常：

/home/runner/.local/share/virtualenvs/python3/lib/python3.7/site-packages/urllib3/connectionpool.py:1004：InsecureRequestWarning：发出未经验证的HTTPS请求。强烈建议添加证书验证。请参阅： https: //urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecureRequestWarning，

根据最新的发行说明，第1.25.5节（2019-09-19）：

为BPO-37428添加缓解措施，影响到Python <3.7.4和OpenSSL 1.1.1+，这导致在使用cert_reqs = CERT_NONE时启用证书验证。（问题1682）

您可以在Github上关注该问题，该问题已关闭。

TLDR

Github上的@sethmlarson 用户在urllib3上发现了此错误：

create_urllib3_context（）：

    # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is
    # necessary for conditional client cert authentication with TLS 1.3.
    # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older
    # versions of Python.
    if getattr(context, "post_handshake_auth", None) is not None:
        context.post_handshake_auth = True

将此值设置为True将启用服务器证书验证，而不是被禁用。