Consider warning caller if supplied client params will in favour of transport

[declension]

First of all, thanks for a great library!

I recently got surprised when debugging something to find that if you do:

import httpx
...

transport = httpx.AsyncHTTPTransport(retries=3)
return httpx.AsyncClient(transport=transport, base_url="https://example.com", trust_env=False, cert=cert)

You won't get cert config trust_env respected (but your base_url will be)

I agree that the precedence logic (transport overriding params) probably makes sense, but it feels risky to take these parameters, some of which set up important security features, and silently ignore them if another parameter is supplied.

It seems some others have been surprised here (See #2888, #2513 (comment))

Note also this might probably come into focus more now, with the deprecation of app=app method of setting up a client (this is how we got to creating a transport manually).

Perhaps a warning of some sort might help here?

[ketpatil77]

The split is between client behavior and transport construction. base_url is used when the client builds requests; TLS settings must configure the transport instance you supplied. For HTTPX 0.28.1, prefer an SSLContext instead of the deprecated client cert= argument:

import ssl
import httpx

def make_client():
    context = ssl.create_default_context()
    # For mutual TLS, load your real files here:
    # context.load_cert_chain("client-cert.pem", "client-key.pem")
    transport = httpx.AsyncHTTPTransport(
        retries=3, verify=context, trust_env=False,
    )
    return httpx.AsyncClient(
        transport=transport, trust_env=False,
        base_url="https://example.com",
    )

Use async with make_client() as client: so the transport is closed. Setting trust_env=False at both boundaries avoids transport environment certificate settings and client environment-proxy routing. An explicit proxy or additional mounted transport would still need its own configuration. ssl.create_default_context() uses the platform/Python default trust configuration; pass an explicit CA file there if you need a controlled custom trust store.

A warning would need to distinguish explicit options from defaults and account for arbitrary third-party transports; the example above does not resolve that API-design question. Validated construction, base-URL handling, and closing on 0.28.1; no real mTLS handshake was tested. SSL configuration, custom transports.

Validation version: HTTPX 0.28.1, Python 3.11.9.