google-auth: Avoid auto-retrying 401s on streaming/non-repeatable payloads in sync HTTP transports
Maintainers usually reply within 1 day
@agrawalradhika-cell is already working on this.
Since Sep 1, 2026.
Assessment
This issue has not been assessed yet.
Description
Determine this is the right repository
- I determined this is the correct repository in which to report this bug.
Summary of the issue
Description
In google.auth.transport.requests.AuthorizedSession and google.auth.transport.urllib3.AuthorizedHttp, receiving a 401 Unauthorized triggers an automatic credential refresh / mTLS channel reconfiguration, followed by a recursive request retry (self.request(...) / self.urlopen(...)).
If the request payload (data or body) is a streaming payload (e.g., a file-like object, generator, or iterator), the initial request consumes the stream. The recursive retry then blindly attempts to send the exact same exhausted stream instance. This results in transmitting a 0-byte body (Content-Length: 0) to the server on the retried attempt.
For streaming payloads, the transport should likely not attempt an automatic retry and instead return the 401 response to the caller so they can safely reconstruct the stream and retry on their end. See HLD: go/sdk-mds-bound-token
Note on implementation: If the fix involves short-circuiting the auto-retry for streaming payloads, it is critical that credential refresh and mTLS channel reconfiguration still execute prior to returning the 401. If the logic returns early before running self.credentials.refresh() and self.configure_mtls_channel(), the internal session state remains stale. When the caller reconstructs the stream and issues a manual retry, it will immediately fail again with the exact same expired token or old mTLS certificate.
Affected Files
packages/google-auth/google/auth/transport/requests.py(AuthorizedSession.request)packages/google-auth/google/auth/transport/urllib3.py(AuthorizedHttp.urlopen)
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1.8k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 173
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-cloud-python
-
firestore: field path with a quoted name ending in a backslash is misparsedPossibly taken @sebxt claimed this 25 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/google-cloud-python#18771 ·
Maintainers usually reply within 1 day
-
api: spanner type: feature request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
googleapis/google-cloud-python#18584 ·
Maintainers usually reply within 1 day
-
auth: `impersonated_credentials` loses `subject` on copy, so `with_scopes()` and `with_quota_project()` turn off domain wide delegationPossibly taken @Om-singhaI claimed this 55 days ago. Openauth priority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
googleapis/google-cloud-python#18428 ·
Maintainers usually reply within 1 day
-
A client called `run_in_transaction` be stuck if Spanner is downPossibly taken @founderinaction claimed this 7 days ago. Openpriority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/google-cloud-python#18375 · 1 comment ·
Maintainers usually reply within 1 day
-
ci: enable --strict flag in presubmit twine_checkMay be free again @ohmayr claimed this 44 days ago, and no pull request is open. Open
Difficulty 1/5 Under an hour Newbie friendliness 76/100
googleapis/google-cloud-python#18339 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
All issues in googleapis/google-cloud-python
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
cpp-best-practices/project_validator#267 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Project-N-E-K-O/N.E.K.O#3725 ·
Maintainers usually reply within 1 day
-
[Bug] Sending a Telegram message chain twice duplicates mentionsPossibly taken @123XieC claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AstrBotDevs/AstrBot#11125 ·
Maintainers usually reply within 1 day
-
backend bug priority: high
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nooriegarg/ContribIQ#73 ·
Maintainers usually reply within 1 day
-
bug p3 security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day