From 188e7609b36eb2100abe3a6a5c3bbebcf1205cfb Mon Sep 17 00:00:00 2001
From: Vikram Oberoi <voberoi@gmail.com>
Date: Thu, 27 Jun 2013 16:43:40 -0400
Subject: [PATCH 1/2] .netrc settings shouldn't blow away explicit auth
 settings on a session

---
 requests/sessions.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/requests/sessions.py b/requests/sessions.py
index 6d1000dc..c24ed5aa 100644
--- a/requests/sessions.py
+++ b/requests/sessions.py
@@ -289,8 +289,8 @@ class Session(SessionRedirectMixin):
             for (k, v) in env_proxies.items():
                 proxies.setdefault(k, v)
 
-            # Set environment's basic authentication.
-            if not auth:
+            # Set environment's basic authentication if not explicitly set.
+            if not auth and not self.auth:
                 auth = get_netrc_auth(url)
 
             # Look for configuration.

From d9c49ad30d1107591f3b5150da6f95ec90c63784 Mon Sep 17 00:00:00 2001
From: Vikram Oberoi <voberoi@gmail.com>
Date: Thu, 27 Jun 2013 17:16:42 -0400
Subject: [PATCH 2/2] Add test to verify .netrc authentication behavior.

Here's what should happen:

- If no credentials are given, use netrc if there's a netrc entry.
- If credentials are given, they should override netrc.
---
 test_requests.py | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/test_requests.py b/test_requests.py
index 7ad10ee9..07582105 100755
--- a/test_requests.py
+++ b/test_requests.py
@@ -234,6 +234,34 @@ class RequestsTestCase(unittest.TestCase):
         r = s.get(url)
         self.assertEqual(r.status_code, 200)
 
+    def test_basicauth_with_netrc(self):
+        auth = ('user', 'pass')
+        wrong_auth = ('wronguser', 'wrongpass')
+        url = httpbin('basic-auth', 'user', 'pass')
+
+        def get_netrc_auth_mock(url):
+            return auth
+        requests.sessions.get_netrc_auth = get_netrc_auth_mock
+
+        # Should use netrc and work.
+        r = requests.get(url)
+        self.assertEqual(r.status_code, 200)
+
+        # Given auth should override and fail.
+        r = requests.get(url, auth=wrong_auth)
+        self.assertEqual(r.status_code, 401)
+
+        s = requests.session()
+        
+        # Should use netrc and work.
+        r = s.get(url)
+        self.assertEqual(r.status_code, 200)
+
+        # Given auth should override and fail.
+        s.auth = wrong_auth
+        r = s.get(url)
+        self.assertEqual(r.status_code, 401)
+
     def test_DIGEST_HTTP_200_OK_GET(self):
 
         auth = HTTPDigestAuth('user', 'pass')