StackExchange / StackExchange/StackExchange.Redis

Question about key rotation & AuthenticationFailure

Open
#2,484 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
6.2k
Forks
1.6k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

Hello team,

I have 'ssl=True,abortConnect=False' in the connection string. I have a few questions regarding the key rotation:

  1. I was told that when the key getting rotated, a RedisConnectionException with FailureType equals to 'AuthenticationFailure' would get thrown. But in my case the failure type is alwasy 'SocketClosed' for a original connected mux.

  2. I was told that the 'the ConfigurationOptions will be respected after the initial connection, updating User and Password at any point will be observed when reconnecting' , but that doesn't seem to be the case if the key was rotated before any connection was established successfully - I have the following code:

    private readonly IConnectionMultiplexer mux;
    private readonly ConfigurationOptions options;
    private readonly Lazy<LoadedLuaScript> lazyLoadedLua = new Lazy<LoadedLuaScript>(() => "#somescript#".Load(this.mux.GetServer(this.mux.GetDatabase().IdentifyEndpoint());

    mux = ConnectionMultiplexer.Connect(options);
    try
    {
        lazyLoadedLua.Value;
    }
    catch (RedisConnectionException redisConnectionException) when (redisConnectionException.FailureType == ConnectionFailureType.AuthenticationFailure)
    {
        this.options.Password = "#RotatedPassword#"
    }

When calling lazyLoadedLua.Value, the RedisConnectionException with FailureType equals to 'AuthenticationFailure' does get thrown, but changing the key on the fly doesn't seem to be respected by the mux as all the subsequent 'Lazy#Value' calls still failed with RedisConnectionException(AuthenticationFailure) - I did reset the Password to the right one.

  1. regarding the setter of ConfigurationOptions#Password - the implementation seems to have bugs as the value set by one thread isn't guaranteed to be seen by other threads - don't we need some memory fence for it?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ConfigurationOptions.Password, ConnectionMultiplexer.Connect, and the reconnect and authentication-failure paths exercised by the provided LazyLoadedLua flow. Reproduce key rotation before and after a successful connection, then inspect the setter's cross-thread behavior. Done means the expected failure type, updated password handling, and visibility across threads are documented or covered by a confirmed fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, redis
Domain
authentication, backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.