Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Per-catalog auth state is shared: commit_table mutates the session, and cached S3FileSystem instances share a signer

Abierto
#3,970 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
aws, python
Área
authentication, backend, cloud

Línea de trabajo

Start by tracing RestCatalog.commit_table and FileIO.get_fs, including the fsspec S3FileSystem instance cache and botocore event registration shown in the issue. Verify isolation with requests from multiple tables and catalogs: table tokens must not persist on the shared session, and each catalog must retain its own signer even when filesystem constructor arguments match.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Two places where authentication state configured for one catalog or table persists onto another.

1. commit_table mutates the shared session's headers

headers = self._session.headers            # the live session mapping, not a copy
if table_token := table.config.get(TOKEN):
    headers[AUTHORIZATION_HEADER] = f"{BEARER_PREFIX} {table_token}"

self._session.headers is the session's own mapping, so assigning into it persists the table-scoped token on the session. Every subsequent request from that RestCatalog carries it, including requests for other tables.

2. fsspec-cached S3FileSystem instances share one signer registration

fs = S3FileSystem(**s3_fs_kwargs)
for event_name, event_function in register_events.items():
    fs.s3.meta.events.unregister(event_name, unique_id=1925)
    fs.s3.meta.events.register_last(event_name, event_function, unique_id=1925)

The signer is registered as a botocore event handler after construction, under a fixed unique_id. It is not part of s3_fs_kwargs, and fsspec caches filesystem instances by constructor arguments (skip_instance_cache is not set). Two catalogs whose anon / client_kwargs / config_kwargs match therefore receive the same S3FileSystem object, and the second unregister + register_last replaces the first catalog's signer with its own.

Note the per-thread lru_cache in get_fs is not involved — _thread_locals is an instance attribute, so that cache is already per-FileIO. The sharing comes from fsspec's instance cache.

Issue investigation generated via claude, reviewed by Sung, Kevin, Fokko.

Lenguaje dominante
Python
Estrellas
1.1k
Forks
589
Merge medio
2 d 2 h
PR fusionados (30 d)
70

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/iceberg-python

Todos los issues de apache/iceberg-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.