Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] WebSocket API: session re-logon after reconnect is sent without apiKey and signature

Cerrado
  • ¿Algo no está bien?
#569 0 comentarios 0 reacciones 0 asignados Ver en GitHub

@Amadeus-22 ya está trabajando en esto.

Desde el 10/10/2026.

  • #572 de @Amadeus-22 — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
74/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
api

Línea de trabajo

Start in common/src/binance_common/websocket.py: read session_re_log_on, then compare it with send_signed_message(..., session_logon=True) and the ws_api_payload options (api_key, skip_auth, is_signed) to see why only timestamp is emitted. Run the repro script from the issue against a local aiohttp server to confirm the three printed outputs, then change the re-logon to build a signed payload and await the server reply before setting connection.is_session_log_on. Done means re-logon params contain apiKey, timestamp, signature, is_session_log_on reflects the reply status, and subsequent signed requests still carry signatures after a failed re-logon.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

After a WebSocket API connection is renewed (scheduled reconnect or serverShutdown), session_re_log_on re-sends session.logon without apiKey and signature, then marks the connection as logged on without waiting for the reply. The server rejects that logon, and every signed request sent afterwards is also unsigned, because the client believes the session is authenticated.

This affects Ed25519 users who call session_logon; session_re_logon is enabled by default.

Where

common/src/binance_common/websocket.py, session_re_log_on:

websocket_options = WebsocketApiOptions(
    signer=signer, api_key=False, is_signed=True, skip_auth=True
)
payload = ws_api_payload(self.configuration, data, websocket_options)
...
await WebSocketCommon.send_message(self, payload, connection)
connection.is_session_log_on = True

With api_key=False and skip_auth=True, ws_api_payload only adds timestamp. The initial logon goes through send_signed_message(..., session_logon=True), which adds apiKey and signature.

Reproduce

Self-contained: a local aiohttp WebSocket server records what the client sends. binance-common==4.5.1 (same as master at 43f19a9), Python 3.13.

import asyncio, json, logging
from aiohttp import web
from Crypto.PublicKey import ECC
from binance_common.configuration import ConfigurationWebSocketAPI
from binance_common.models import WebsocketApiUserDataEndpoints
from binance_common.signature import Signers
from binance_common.websocket import WebSocketAPIBase
logging.disable(logging.CRITICAL)
received = []
async def handler(request):
    ws = web.WebSocketResponse(); await ws.prepare(request)
    async for msg in ws:
        d = json.loads(msg.data); received.append(d)
        p = d.get("params", {})
        if d["method"] == "session.logon" and not ("apiKey" in p and "signature" in p):
            await ws.send_json({"id": d["id"], "status": 400, "error": {"code": -1102, "msg": "Mandatory parameter 'apiKey' was not sent"}})
        else:
            await ws.send_json({"id": d["id"], "status": 200, "result": {}, "rateLimits": []})
    return ws
async def main():
    app = web.Application(); app.router.add_get("/ws", handler)
    r = web.AppRunner(app); await r.setup(); await web.TCPSite(r, "127.0.0.1", 18765).start()
    pem = ECC.generate(curve="ed25519").export_key(format="PEM")
    cfg = ConfigurationWebSocketAPI(api_key="KEY", private_key=pem, stream_url="ws://127.0.0.1:18765/ws", reconnect_delay=100)
    api = WebSocketAPIBase(cfg, WebsocketApiUserDataEndpoints(user_data_stream_subscribe="userDataStream.subscribe", user_data_stream_logout="session.logout"))
    signer = Signers.get_signer(pem)
    await api.create_connection()
    await api.send_signed_message({"method": "session.logon", "params": {}}, signer=signer, session_logon=True)
    print("1 initial logon   params keys:", sorted(received[-1]["params"]))
    await api.reconnect(api.connections[0], cfg)      # what the 23h auto-reconnect / serverShutdown does
    await asyncio.sleep(0.3)
    relog = [m for m in received if m["method"] == "session.logon"][-1]
    print("2 re-logon        params keys:", sorted(relog["params"]))
    print("  connection.is_session_log_on =", api.connections[0].is_session_log_on)
    await api.send_signed_message({"method": "order.place", "params": {"symbol": "BTCUSDT"}}, signer=signer, api_key=True)
    print("3 order after rec params keys:", sorted(received[-1]["params"]))
    await api.close_connection()
    await r.cleanup()
asyncio.run(main())

Output:

1 initial logon   params keys: ['apiKey', 'signature', 'timestamp']
2 re-logon        params keys: ['timestamp']
  connection.is_session_log_on = True
3 order after rec params keys: ['symbol', 'timestamp']

Sending a session.logon with only timestamp to the Spot testnet WebSocket API returns 400, code -1102, Mandatory parameter 'apiKey' was not sent.

Expected

The re-logon carries the same apiKey, timestamp and signature as the first logon, and is_session_log_on only becomes True when the server answers with status 200.

Suggested fix

Build the re-logon payload with api_key=True, skip_auth=False (new timestamp and signature), wait for the response, and set is_session_log_on from its status. On failure, leave it False so later requests keep being signed individually.

Lenguaje dominante
Python
Estrellas
2.9k
Forks
708
Merge medio
1 d 5 h
PR fusionados (30 d)
4

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de binance/binance-connector-python

Todos los issues de binance/binance-connector-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.