Skip to content

fix(oauth2_http): Avoid retrying on 403 Forbidden during GCE metadata ping #13707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
macastelaz wants to merge 4 commits into from
Closed

fix(oauth2_http): Avoid retrying on 403 Forbidden during GCE metadata ping #13707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fea5c07
fix(oauth2_http): avoid retrying on 403 Forbidden during GCE metadata…
macastelaz Jul 8, 2026
5f0f25a
test: assert exactly 1 request is made on 403 in isOnGce_forbidden_do…
macastelaz Jul 8, 2026
be67e65
fix(oauth2_http): downgrade instanceof pattern matching for Java 8 co…
macastelaz Jul 8, 2026
1cb6a68
test: add getRequestCount to MockMetadataServerTransport to support v…
macastelaz Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions ...e-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -673,6 +673,10 @@ private static boolean pingComputeEngineMetadata(
} catch (SocketTimeoutException expected) {
// Ignore logging timeouts which is the expected failure mode in non GCE environments.
} catch (IOException e) {
if (e instanceof HttpResponseException
&& ((HttpResponseException) e).getStatusCode() == 403) {
return false;
}
LOGGER.log(
Level.FINE,
"Encountered an unexpected exception when checking"
Expand Down
10 changes: 10 additions & 0 deletions ...brary-java/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1177,6 +1177,16 @@ void getProjectId_explicitSet_noMDsCall() {
assertEquals(0, transportFactory.transport.getRequestCount());
}

@Test
void isOnGce_forbidden_doesNotRetry() {
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
DefaultCredentialsProvider provider = new DefaultCredentialsProvider();
boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
assertFalse(isOnGce);
assertEquals(1, transportFactory.transport.getRequestCount());
}
Comment on lines +1185 to +1188

@gemini-code-assist gemini-code-assist Bot Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The test isOnGce_forbidden_doesNotRetry asserts that isOnGce returns false, but it does not verify that the request was not retried. If a regression is introduced where the client still retries on a 403 response, the test would still pass because isOnGce would eventually return false after exhausting the retries. To ensure that we actually avoid retrying, assert that the request count is exactly 1.

Suggested change
boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
assertFalse(isOnGce);
}
boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
assertFalse(isOnGce);
assertEquals(1, transportFactory.transport.getRequestCount());
}


static class MockMetadataServerTransportFactory implements HttpTransportFactory {

MockMetadataServerTransport transport =
Expand Down
6 changes: 6 additions & 0 deletions ...ibrary-java/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,11 @@ public class MockMetadataServerTransport extends MockHttpTransport {

private boolean emptyContent;
private MockLowLevelHttpRequest request;
private int requestCount = 0;

public int getRequestCount() {
return requestCount;
}

public MockMetadataServerTransport() {}

Expand Down Expand Up @@ -125,6 +130,7 @@ public MockLowLevelHttpRequest getRequest() {

@Override
public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
requestCount++;
if (url.startsWith(ComputeEngineCredentials.getTokenServerEncodedUrl())) {
this.request = getMockRequestForTokenEndpoint(url);
return this.request;
Expand Down
Loading