googleapis / googleapis/google-cloud-php

[Auth] FileSystemCacheItemPool implementation is broken, it loses expiration information and causes stale auth token usage

Open
#9,669 1 comment 0 reactions 1 assignee Claimed by @cy-yun View on GitHub
Dominant language
PHP
Stars
1.2k
Forks
463
Avg merge
2d 1h
Merged PRs (30d)
145

Description

#### Environment details

- OS: Linux in Docker/Kubernetes
- PHP version: 8.3
- Package name and version: google/auth 1.53

#### Steps to reproduce

1. When creating StorageClient, use config option 'authCache' => new \Google\Auth\Cache\FileSystemCacheItemPool('/tmp/some/dir/storage_auth')
2. Use the StorageClient for a while until the authentication expires
3. Witness 401 errors for storage actions

Checking the FileSystemCacheItemPool the root cause becomes clear:
serializing to disk does:
```php
$serializedItem = serialize($item->get());

$result = file_put_contents($itemPath, $serializedItem, LOCK_EX);
```
This means that expiration value does not get written to disk at all, only the final value.
As a result when the value is asked from the cache with getItem call, it never fills expiration field.
TypedItem->isHit() returns true if expiration === null, making storage client use stale auth token.

Current implementations of MemoryCacheItemPool and SysVCacheItemPool retain the entire object and do not have this same issue.

Looking into CacheTrait the getCachedValue() has strong assumption that getItem() returns an object where isHit() call defines it valid item was found or not, it does not do any extra expiration checks etc.
This is the TypedItem->isHit() function:
```php
public function isHit(): bool
{
if (!$this->isHit) {
return false;
}

if ($this->expiration === null) {
return true;
}

return $this->currentTime()->getTimestamp() < $this->expiration->getTimestamp();
}
```

In addition the CacheTrait->getCachedValue() function is missing explicit return null; as final line of function.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.