Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug] WebSocket API: session re-logon after reconnect is sent without apiKey and signature

Open
  • Is something wrong?
#569 0 comments 0 reactions 0 assignees View on GitHub

@Amadeus-22 is already working on this.

Since Oct 10, 2026.

  • #572 by @Amadeus-22 — open

Assessment

Difficulty
3/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
api

Research direction

Start in common/src/binance_common/websocket.py: read session_re_log_on, then compare it with send_signed_message(..., session_logon=True) and the ws_api_payload options (api_key, skip_auth, is_signed) to see why only timestamp is emitted. Run the repro script from the issue against a local aiohttp server to confirm the three printed outputs, then change the re-logon to build a signed payload and await the server reply before setting connection.is_session_log_on. Done means re-logon params contain apiKey, timestamp, signature, is_session_log_on reflects the reply status, and subsequent signed requests still carry signatures after a failed re-logon.

Written by the indexing model from the issue text.

Description

Summary

After a WebSocket API connection is renewed (scheduled reconnect or serverShutdown), session_re_log_on re-sends session.logon without apiKey and signature, then marks the connection as logged on without waiting for the reply. The server rejects that logon, and every signed request sent afterwards is also unsigned, because the client believes the session is authenticated.

This affects Ed25519 users who call session_logon; session_re_logon is enabled by default.

Where

common/src/binance_common/websocket.py, session_re_log_on:

websocket_options = WebsocketApiOptions(
    signer=signer, api_key=False, is_signed=True, skip_auth=True
)
payload = ws_api_payload(self.configuration, data, websocket_options)
...
await WebSocketCommon.send_message(self, payload, connection)
connection.is_session_log_on = True

With api_key=False and skip_auth=True, ws_api_payload only adds timestamp. The initial logon goes through send_signed_message(..., session_logon=True), which adds apiKey and signature.

Reproduce

Self-contained: a local aiohttp WebSocket server records what the client sends. binance-common==4.5.1 (same as master at 43f19a9), Python 3.13.

import asyncio, json, logging
from aiohttp import web
from Crypto.PublicKey import ECC
from binance_common.configuration import ConfigurationWebSocketAPI
from binance_common.models import WebsocketApiUserDataEndpoints
from binance_common.signature import Signers
from binance_common.websocket import WebSocketAPIBase
logging.disable(logging.CRITICAL)
received = []
async def handler(request):
    ws = web.WebSocketResponse(); await ws.prepare(request)
    async for msg in ws:
        d = json.loads(msg.data); received.append(d)
        p = d.get("params", {})
        if d["method"] == "session.logon" and not ("apiKey" in p and "signature" in p):
            await ws.send_json({"id": d["id"], "status": 400, "error": {"code": -1102, "msg": "Mandatory parameter 'apiKey' was not sent"}})
        else:
            await ws.send_json({"id": d["id"], "status": 200, "result": {}, "rateLimits": []})
    return ws
async def main():
    app = web.Application(); app.router.add_get("/ws", handler)
    r = web.AppRunner(app); await r.setup(); await web.TCPSite(r, "127.0.0.1", 18765).start()
    pem = ECC.generate(curve="ed25519").export_key(format="PEM")
    cfg = ConfigurationWebSocketAPI(api_key="KEY", private_key=pem, stream_url="ws://127.0.0.1:18765/ws", reconnect_delay=100)
    api = WebSocketAPIBase(cfg, WebsocketApiUserDataEndpoints(user_data_stream_subscribe="userDataStream.subscribe", user_data_stream_logout="session.logout"))
    signer = Signers.get_signer(pem)
    await api.create_connection()
    await api.send_signed_message({"method": "session.logon", "params": {}}, signer=signer, session_logon=True)
    print("1 initial logon   params keys:", sorted(received[-1]["params"]))
    await api.reconnect(api.connections[0], cfg)      # what the 23h auto-reconnect / serverShutdown does
    await asyncio.sleep(0.3)
    relog = [m for m in received if m["method"] == "session.logon"][-1]
    print("2 re-logon        params keys:", sorted(relog["params"]))
    print("  connection.is_session_log_on =", api.connections[0].is_session_log_on)
    await api.send_signed_message({"method": "order.place", "params": {"symbol": "BTCUSDT"}}, signer=signer, api_key=True)
    print("3 order after rec params keys:", sorted(received[-1]["params"]))
    await api.close_connection()
    await r.cleanup()
asyncio.run(main())

Output:

1 initial logon   params keys: ['apiKey', 'signature', 'timestamp']
2 re-logon        params keys: ['timestamp']
  connection.is_session_log_on = True
3 order after rec params keys: ['symbol', 'timestamp']

Sending a session.logon with only timestamp to the Spot testnet WebSocket API returns 400, code -1102, Mandatory parameter 'apiKey' was not sent.

Expected

The re-logon carries the same apiKey, timestamp and signature as the first logon, and is_session_log_on only becomes True when the server answers with status 200.

Suggested fix

Build the re-logon payload with api_key=True, skip_auth=False (new timestamp and signature), wait for the response, and set is_session_log_on from its status. On failure, leave it False so later requests keep being signed individually.

Dominant language
Python
Stars
2.9k
Forks
708
Avg merge
2h 17m
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from binance/binance-connector-python

All issues in binance/binance-connector-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.