ureq

ureq is a Rust HTTP client built around blocking I/O instead of async, keeping its API surface and dependency tree small while still covering the features most applications actually need: JSON, cookies, HTTP/SOCKS proxies, HTTPS via rustls or native-tls, charset decoding, and multipart/form-data. Its #![forbid(unsafe_code)] stance and pure-Rust TLS defaults (rustls with the ring provider) make it a deliberately conservative, easy-to-audit choice for applications that don’t need an async runtime.

The crate favors an Agent-based design for connection pooling and shared configuration, with sensible crate-level convenience functions (ureq::get(...)) for simple one-off calls. Nearly every optional capability — TLS backend, compression, cookies, SOCKS proxying, JSON — is gated behind Cargo features, so a project only pays (in compile time and binary size) for what it actually uses.

What You Get

• Blocking ureq::get/post/etc. convenience functions plus a reusable, connection-pooling Agent for repeated requests
• Pluggable TLS backends (rustls with ring, or native-tls) selected via Cargo features, with platform-verifier support for OS-native certificate checking
• Opt-in JSON (send_json/read_json via serde_json), cookies, multipart/form-data, and gzip/brotli response decompression
• SOCKS4/SOCKS5 and HTTP proxy support via the socks-proxy feature
• A #![forbid(unsafe_code)] pure-Rust implementation with a deliberately minimal default dependency footprint

Common Use Cases

• Calling REST/JSON HTTP APIs from a CLI tool or server that doesn’t otherwise need an async runtime
• Building small, dependency-conscious Rust binaries where pulling in tokio/hyper would be disproportionate to the app’s needs
• Making HTTPS requests with a choice of TLS backend (rustls vs native-tls) and root-certificate strategy (webpki-roots vs platform-verifier)
• Sending multipart form uploads or URL-encoded form data without adopting a full async HTTP stack

Under The Hood

Architecture - The crate is organized around agent.rs (connection pooling and shared config), request.rs/response.rs (the request builder and response types), run.rs (executes a request over a pooled or new connection), and middleware.rs (a hook point for intercepting requests/responses). Optional capabilities are isolated into their own modules — cookies.rs, multipart.rs, proxy.rs, query.rs — each compiled in only when its corresponding Cargo feature is enabled, and config.rs centralizes the builder-style Agent::config_builder() API for TLS, timeouts, and proxy settings.

Tech Stack - Written in 99.7% Rust with essentially no required dependencies by default; optional features pull in rustls+ring or native-tls for TLS, serde_json for JSON, cookie_store for cookies, and socks/winreg for proxy support — each strictly opt-in via Cargo feature flags rather than bundled by default.

Code Quality - Rather than a separate top-level tests/ directory, tests are written inline across roughly 20 source files using Rust’s standard #[test] convention, exercising request building, TLS config, proxying, and body handling directly alongside the implementation. The crate has been maintained since 2018 (1,302 commits) primarily by its original author, with README generated directly from src/lib.rs doc comments to keep documentation and code in sync.

API Design - The simplest call is a single expression — ureq::get(url).call()?.body_mut().read_to_string()? — while the Agent/Config builder pattern scales up to connection reuse, custom TLS, and proxy settings without changing the basic call shape. Errors are returned as Result<T, ureq::Error> with a dedicated StatusCode variant, so HTTP-level failures are distinguishable from I/O/transport errors without extra boilerplate.