Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Per-request Authorization and X-Server-Timeout leak into the client's default headers (stale token in Interactions and Live)

Abierto
  • ¿Algo no está bien?
#3,158 3 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@Venkaiahbabuneelam ya está trabajando en esto.

Desde el 19/10/2026.

  • #3159 de @Priyanshujindal — abierto
  • #3182 de @copybara-service — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
backend-api-design

Línea de trabajo

Start by reading BaseApiClient._build_request in _api_client.py and the header handling in _gaos/google_genai.py and live.py. Run the mentioned _build_request unit test and add or run regression coverage for sync and async models-to-Interactions and models-to-Live flows. Done means request-specific headers no longer mutate client defaults, refreshed tokens and per-request timeouts are used, and Live sets the quota project itself.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

priority: p2 type: bug
Description

When a request is sent without per-request http_options, BaseApiClient._build_request reuses the client's own self._http_options.headers dict for the request. The request path then writes per-request values into it:

  • X-Server-Timeout, via populate_server_timeout_header (_api_client.py ~1545);
  • Authorization and x-goog-user-project (~1564–1566 and ~1641–1645).

Those values become client defaults, and other code reads them as such:

  • Interactions bridge: it snapshots the client's headers (_gaos/google_genai.py ~99–103), and _apply_default_headers copies the stale Authorization onto every request. _apply_auth then skips the fresh token because a header is already set.
  • Live: live.connect only sets Authorization if it's absent (live.py ~1141).
  • Server timeout: populate_server_timeout_header only sets X-Server-Timeout if it's absent.
Impact
  • Vertex AI with ADC or credentials: if any REST call (e.g. models.generate_content) runs before client.interactions (or the other Interactions-layer resources) is first used, those requests send the first bearer token for the life of the process. Once that token expires, after about an hour, they start failing with 401. Long-running servers hit this.
  • Live: it connects with the token from the last REST call, even after a refresh.
  • Timeouts: with a client-level timeout, a later per-request timeout still sends the earlier X-Server-Timeout, and the server enforces it. So the same call behaves differently depending on what ran before.
Repro (offline, mocked transport, fake credentials)
import httpx
import google.oauth2.credentials
from google import genai
from google.genai import types

GEN = {'candidates': [{'content': {'role': 'model', 'parts': [{'text': 'ok'}]}, 'finishReason': 'STOP'}]}
INTERACTION = {'id': 'abc', 'status': 'completed', 'outputs': [], 'object': 'interaction',
               'created': '2026-01-01T00:00:00Z', 'updated': '2026-01-01T00:00:00Z'}
sent = []


def handler(request: httpx.Request) -> httpx.Response:
  kind = 'interactions' if '/interactions/' in request.url.path else 'models'
  sent.append((kind, request.headers.get('authorization')))
  return httpx.Response(200, json=INTERACTION if kind == 'interactions' else GEN)


creds = google.oauth2.credentials.Credentials(token='token-1')
client = genai.Client(
    vertexai=True, project='p', location='us-central1', credentials=creds,
    http_options=types.HttpOptions(httpx_client=httpx.Client(transport=httpx.MockTransport(handler))),
)

client.models.generate_content(model='gemini-2.5-flash', contents='hi')
creds.token = 'token-2'  # what google-auth does when it refreshes the token
client.interactions.get(id='abc')
client.models.generate_content(model='gemini-2.5-flash', contents='hi')
creds.token = 'token-3'
client.interactions.get(id='abc')

for kind, auth in sent:
  print(f'{kind:13s} {auth}')
print('client default headers:', {k: v for k, v in client._api_client._http_options.headers.items() if k.lower() in ('authorization', 'x-server-timeout')})

Output on main (364889aa, google-genai 2.31.0):

models        Bearer token-1
interactions  Bearer token-1
models        Bearer token-2
interactions  Bearer token-1      <- credentials hold token-3
client default headers: {'Authorization': 'Bearer token-2'}

If interactions is used before any models call, it gets the fresh token each time, so this depends on call order.

Proposed fix

Copy the headers at the one place that builds per-request headers, so per-request values stay on the HttpRequest:

@@ class BaseApiClient: def _build_request(
     if patched_http_options.headers is None:
       raise ValueError('Request headers must be set.')
-    populate_server_timeout_header(
-        patched_http_options.headers, timeout_in_seconds
-    )
+    # Without per-request options, patched_http_options is the client's own
+    # options. Copy the headers so that this request's X-Server-Timeout, and
+    # the Authorization header set when it is sent, do not become client
+    # defaults that later requests, Interactions and Live reuse.
+    headers = dict(patched_http_options.headers)
+    populate_server_timeout_header(headers, timeout_in_seconds)
     return HttpRequest(
         method=http_method,
         url=url,
-        headers=patched_http_options.headers,
+        headers=headers,
         data=request_dict,
         timeout=timeout_in_seconds,
     )

With this, Interactions and Live always send the current token, X-Server-Timeout matches each request's timeout, and the client's default headers stay as configured. It covers sync and async and every transport.

I'd rather not patch the readers (filter Authorization in the bridge, always overwrite X-Server-Timeout). That would be three separate patches, and it would break the existing rule that a user-set X-Server-Timeout wins (test_server_timeout_not_overwritten).

One behaviour change worth noting: on Vertex, Live currently only gets x-goog-user-project incidentally, after some REST call has written it into the shared headers. With this fix it won't, so Live should set it itself from credentials.quota_project_id.

I have regression tests that fail on main:

  • a unit test on _build_request;
  • sync and async models → Interactions;
  • models → Live.

Happy to open a PR.

Lenguaje dominante
Python
Estrellas
4k
Forks
1k
Merge medio
1 d 14 h
PR fusionados (30 d)
101

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de googleapis/python-genai

Todos los issues de googleapis/python-genai

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.