Repository navigation
Refuse static credentials with stray whitespace or control characters in Client (server#554) #304
Description
Moved from durable-workflow/server#554. The Server part shipped in native 3.5.0: boot refuses a token with leading or trailing whitespace or a control character, and names only the setting (server#1126). PHP (tests/StaticCredentialValidationTest.php) and Rust (sdk-rust#211) validate in their client constructors. Python doesn't yet.
Problem: Client.__init__ stores token, control_token and worker_token unchanged. A token read from a Kubernetes Secret file with a trailing newline becomes a silent 401 on every request.
Acceptance:
Clientvalidates every suppliedtoken,control_tokenandworker_tokenbefore role fallback. Values with White_Space at either edge or a Cc control character anywhere are refused. Values are never trimmed.- The error names the option only, never the value, a prefix or a digest.
Noneand supplied empty-string behavior and role precedence stay as they are today, matching the shared fixture.- Tests consume the canonical fixture
tests/Fixtures/AuthConfiguration/static-credentials-v1.jsonfrom durable-workflow/server (60,716 bytes, SHA-2560d4f01b7…, 319 cases), as sdk-php and sdk-rust do. They fail on current main and pass with the fix.
Owner: sdk-python.
Activity
rmcdaniel commentedon Nov 13, 2026
Owner: sdk-python. Implementing constructor validation on fix/sdk-python-304-static-credentials. The canonical Server fixture matches the published 60,716-byte SHA-256. Next: demonstrate the current failure, validate every supplied option before role selection, and run the shared vectors plus client regression checks. Empty/None behavior and token precedence stay unchanged.
rmcdaniel commentedon Nov 13, 2026
Current source is PR #312 at d736243, with all 21 checks green. Shared fixture bytes remain canonical, and 1,257 combined regression/client checks pass locally. Security has the exact constructor-validation head for review. Owner: sdk-python. Next: merge after that verdict, include it in 2.17.1 (#314), then verify the installed package before closing this issue.
rmcdaniel commentedon Nov 13, 2026
Security passed exact head d736243 and all 21 checks are green. The constructor fix is now merging through #312. Owner: sdk-python; remaining action is the 2.17.1 publication and installed canonical-fixture verification in release PR #314. This issue stays open until that package result is recorded.
rmcdaniel commentedon Nov 13, 2026
Delivered in PyPI durable-workflow==2.17.1: https://github.com/durable-workflow/sdk-python/releases/tag/2.17.1 . Reviewed #312 shipped through #314. A clean PyPI install passed the unchanged canonical Server fixture and role/empty/None controls as part of 1,089 installed-package checks. Invalid original token/control_token/worker_token values fail during construction with setting-name-only errors; no value is trimmed. Publication and installed evidence are on #314.