google-auth: Avoid auto-retrying 401s on streaming/non-repeatable payloads in sync HTTP transports

Abierto
  • ¿Algo no está bien?
#18,238 2 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@agrawalradhika-cell ya está trabajando en esto.

Desde el 1/9/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

auth priority: p2 type: bug
Determine this is the right repository
  • I determined this is the correct repository in which to report this bug.
Summary of the issue
Description

In google.auth.transport.requests.AuthorizedSession and google.auth.transport.urllib3.AuthorizedHttp, receiving a 401 Unauthorized triggers an automatic credential refresh / mTLS channel reconfiguration, followed by a recursive request retry (self.request(...) / self.urlopen(...)).

If the request payload (data or body) is a streaming payload (e.g., a file-like object, generator, or iterator), the initial request consumes the stream. The recursive retry then blindly attempts to send the exact same exhausted stream instance. This results in transmitting a 0-byte body (Content-Length: 0) to the server on the retried attempt.

For streaming payloads, the transport should likely not attempt an automatic retry and instead return the 401 response to the caller so they can safely reconstruct the stream and retry on their end. See HLD: go/sdk-mds-bound-token

Note on implementation: If the fix involves short-circuiting the auto-retry for streaming payloads, it is critical that credential refresh and mTLS channel reconfiguration still execute prior to returning the 401. If the logic returns early before running self.credentials.refresh() and self.configure_mtls_channel(), the internal session state remains stale. When the caller reconstructs the stream and issues a manual retry, it will immediately fail again with the exact same expired token or old mTLS certificate.

Affected Files
  • packages/google-auth/google/auth/transport/requests.py (AuthorizedSession.request)
  • packages/google-auth/google/auth/transport/urllib3.py (AuthorizedHttp.urlopen)
Lenguaje dominante
Python
Estrellas
5.4k
Forks
1.8k
Merge medio
2 d 7 h
PR fusionados (30 d)
173

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de googleapis/google-cloud-python

Todos los issues de googleapis/google-cloud-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.