Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Per-request Authorization and X-Server-Timeout leak into the client's default headers (stale token in Interactions and Live)

Aperta
  • Qualcosa non va?
#3,158 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@Priyanshujindal ci sta già lavorando.

Dal 17/10/2026.

  • #3159 di @Priyanshujindal — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
backend-api-design

Direzione di ricerca

Start by reading BaseApiClient._build_request in _api_client.py and the header handling in _gaos/google_genai.py and live.py. Run the mentioned _build_request unit test and add or run regression coverage for sync and async models-to-Interactions and models-to-Live flows. Done means request-specific headers no longer mutate client defaults, refreshed tokens and per-request timeouts are used, and Live sets the quota project itself.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description

When a request is sent without per-request http_options, BaseApiClient._build_request reuses the client's own self._http_options.headers dict for the request. The request path then writes per-request values into it:

  • X-Server-Timeout, via populate_server_timeout_header (_api_client.py ~1545);
  • Authorization and x-goog-user-project (~1564–1566 and ~1641–1645).

Those values become client defaults, and other code reads them as such:

  • Interactions bridge: it snapshots the client's headers (_gaos/google_genai.py ~99–103), and _apply_default_headers copies the stale Authorization onto every request. _apply_auth then skips the fresh token because a header is already set.
  • Live: live.connect only sets Authorization if it's absent (live.py ~1141).
  • Server timeout: populate_server_timeout_header only sets X-Server-Timeout if it's absent.
Impact
  • Vertex AI with ADC or credentials: if any REST call (e.g. models.generate_content) runs before client.interactions (or the other Interactions-layer resources) is first used, those requests send the first bearer token for the life of the process. Once that token expires, after about an hour, they start failing with 401. Long-running servers hit this.
  • Live: it connects with the token from the last REST call, even after a refresh.
  • Timeouts: with a client-level timeout, a later per-request timeout still sends the earlier X-Server-Timeout, and the server enforces it. So the same call behaves differently depending on what ran before.
Repro (offline, mocked transport, fake credentials)
import httpx
import google.oauth2.credentials
from google import genai
from google.genai import types

GEN = {'candidates': [{'content': {'role': 'model', 'parts': [{'text': 'ok'}]}, 'finishReason': 'STOP'}]}
INTERACTION = {'id': 'abc', 'status': 'completed', 'outputs': [], 'object': 'interaction',
               'created': '2026-01-01T00:00:00Z', 'updated': '2026-01-01T00:00:00Z'}
sent = []


def handler(request: httpx.Request) -> httpx.Response:
  kind = 'interactions' if '/interactions/' in request.url.path else 'models'
  sent.append((kind, request.headers.get('authorization')))
  return httpx.Response(200, json=INTERACTION if kind == 'interactions' else GEN)


creds = google.oauth2.credentials.Credentials(token='token-1')
client = genai.Client(
    vertexai=True, project='p', location='us-central1', credentials=creds,
    http_options=types.HttpOptions(httpx_client=httpx.Client(transport=httpx.MockTransport(handler))),
)

client.models.generate_content(model='gemini-2.5-flash', contents='hi')
creds.token = 'token-2'  # what google-auth does when it refreshes the token
client.interactions.get(id='abc')
client.models.generate_content(model='gemini-2.5-flash', contents='hi')
creds.token = 'token-3'
client.interactions.get(id='abc')

for kind, auth in sent:
  print(f'{kind:13s} {auth}')
print('client default headers:', {k: v for k, v in client._api_client._http_options.headers.items() if k.lower() in ('authorization', 'x-server-timeout')})

Output on main (364889aa, google-genai 2.31.0):

models        Bearer token-1
interactions  Bearer token-1
models        Bearer token-2
interactions  Bearer token-1      <- credentials hold token-3
client default headers: {'Authorization': 'Bearer token-2'}

If interactions is used before any models call, it gets the fresh token each time, so this depends on call order.

Proposed fix

Copy the headers at the one place that builds per-request headers, so per-request values stay on the HttpRequest:

@@ class BaseApiClient: def _build_request(
     if patched_http_options.headers is None:
       raise ValueError('Request headers must be set.')
-    populate_server_timeout_header(
-        patched_http_options.headers, timeout_in_seconds
-    )
+    # Without per-request options, patched_http_options is the client's own
+    # options. Copy the headers so that this request's X-Server-Timeout, and
+    # the Authorization header set when it is sent, do not become client
+    # defaults that later requests, Interactions and Live reuse.
+    headers = dict(patched_http_options.headers)
+    populate_server_timeout_header(headers, timeout_in_seconds)
     return HttpRequest(
         method=http_method,
         url=url,
-        headers=patched_http_options.headers,
+        headers=headers,
         data=request_dict,
         timeout=timeout_in_seconds,
     )

With this, Interactions and Live always send the current token, X-Server-Timeout matches each request's timeout, and the client's default headers stay as configured. It covers sync and async and every transport.

I'd rather not patch the readers (filter Authorization in the bridge, always overwrite X-Server-Timeout). That would be three separate patches, and it would break the existing rule that a user-set X-Server-Timeout wins (test_server_timeout_not_overwritten).

One behaviour change worth noting: on Vertex, Live currently only gets x-goog-user-project incidentally, after some REST call has written it into the shared headers. With this fix it won't, so Live should set it itself from credentials.quota_project_id.

I have regression tests that fail on main:

  • a unit test on _build_request;
  • sync and async models → Interactions;
  • models → Live.

Happy to open a PR.

Lingua principale
Python
Stelle
4k
Fork
1k
Merge medio
1g 8h
PR unite (30g)
88

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di googleapis/python-genai

Tutte le issue di googleapis/python-genai

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.