fix(google-auth): fail loudly when dynamically disabling mTLS on active sessions - #18005
fix(google-auth): fail loudly when dynamically disabling mTLS on active sessions#18005gorthitk wants to merge 1 commit into
Conversation
…ve sessions (googleapis#17761) When mTLS is previously enabled on an active transport session (requests, urllib3, or aiohttp), attempting to disable mTLS mid-lifecycle in configure_mtls_channel() now raises a MutualTLSChannelError instead of exiting early or replacing adapters. This prevents thread-safety violations from connection pool mutation and eliminates zombie state mismatches where active sessions continue sending client certificates while auth checks treat mTLS as disabled.
gorthitk
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request prevents mid-lifecycle transitions from mTLS-enabled to mTLS-disabled states on active sessions across the aio, requests, and urllib3 transports by raising a MutualTLSChannelError. However, the review feedback highlights that raising this exception replaces historical graceful fallback behaviors (such as falling back to standard TLS or returning False), which introduces breaking changes for downstream users and violates backwards compatibility.
| if getattr(self, "_is_mtls", False): | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedSession must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
| if getattr(self, "_is_mtls", False) and not is_mtls: | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedSession must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
| if getattr(self, "_is_mtls", False): | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedSession must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior (falling back to standard TLS/HTTPAdapter) with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
| if getattr(self, "_is_mtls", False) and not is_mtls: | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedSession must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
| if getattr(self, "_is_mtls", False): | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedHttp must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior (returning False and falling back to standard TLS/PoolManager) with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
| if getattr(self, "_is_mtls", False) and not found_cert_key: | ||
| raise exceptions.MutualTLSChannelError( | ||
| "Cannot disable mTLS on an active session. A new AuthorizedHttp must be created." | ||
| ) |
There was a problem hiding this comment.
Raising a MutualTLSChannelError exception here replaces the historical graceful fallback behavior with an exception. This introduces breaking changes for downstream users and violates backwards compatibility.
References
- Do not replace historical graceful fallback behaviors (such as returning False/falling back to standard TLS) with exceptions if doing so would introduce breaking changes for downstream users and violate backwards compatibility.
1 participant
When mTLS is previously enabled on an active transport session (requests, urllib3, or aiohttp), attempting to disable mTLS mid-lifecycle in configure_mtls_channel() now raises a MutualTLSChannelError instead of exiting early or replacing adapters.
This prevents thread-safety violations from connection pool mutation and eliminates zombie state mismatches where active sessions continue sending client certificates while auth checks treat mTLS as disabled.
Fixes #17761