Skip to content

Bound credential operations and prevent authentication resource contention #2082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Tyrie Vella (tyrielv) wants to merge 2 commits into
base: vnext
Choose a base branch
from
Draft

Bound credential operations and prevent authentication resource contention #2082

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
faa01d3
Bound runtime credential fetch so prefetch can't hang on auth
tyrielv Jul 8, 2026
08ad141
Prevent authentication resource contention and bound credential opera…
tyrielv Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions GVFS/GVFS.Common/GVFSConstants.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,13 @@ public static class GitConfig

public const string MaxHttpConnectionsConfig = GVFSPrefix + "max-http-connections";

/// <summary>
/// Overrides how long credential operations started by HTTP requests can wait for
/// the credential manager, in seconds. 0 or negative selects an unbounded wait.
/// Startup authentication continues to use its fixed startup bound.
/// </summary>
public const string CredentialTimeoutSeconds = GVFSPrefix + "credential-timeout-seconds";

public const string PrefetchUseIdx = GVFSPrefix + "prefetch-use-idx";
public const bool PrefetchUseIdxDefault = false;

Expand All @@ -95,6 +102,7 @@ public static class GitConfig

public const string PrefetchOffload = GVFSPrefix + "prefetch-offload";
public const bool PrefetchOffloadDefault = false;

}

public static class LocalGVFSConfig
Expand Down
19 changes: 14 additions & 5 deletions GVFS/GVFS.Common/Git/GVFSGitObjects.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,11 +70,13 @@ internal class DownloadAttemptResult
public DownloadAttemptResult(
DownloadAndSaveObjectResult result,
HttpStatusCode? httpStatusCode,
bool shouldRecordFailure = true)
bool shouldRecordFailure = true,
bool credentialOperationTimedOut = false)
{
this.Result = result;
this.HttpStatusCode = httpStatusCode;
this.ShouldRecordFailure = shouldRecordFailure;
this.CredentialOperationTimedOut = credentialOperationTimedOut;
}

public DownloadAndSaveObjectResult Result { get; }
Expand All @@ -84,6 +86,8 @@ public DownloadAttemptResult(
public HttpStatusCode? HttpStatusCode { get; }

public bool ShouldRecordFailure { get; }

public bool CredentialOperationTimedOut { get; }
}

protected GVFSContext Context { get; private set; }
Expand Down Expand Up @@ -171,6 +175,7 @@ public virtual bool TryCopyBlobContentStream(

capturedCategory = category;
metadata.Add(nameof(BlobHydrationFailureCategory), category.ToString());
metadata.Add("CredentialOperationTimedOut", lastDownloadResult?.CredentialOperationTimedOut ?? false);

// Surface the HTTP status of the last download attempt so telemetry can tell a
// genuine auth failure (401/400/302) apart from a transient one (408/5xx/503),
Expand Down Expand Up @@ -225,7 +230,7 @@ public virtual bool TryCopyBlobContentStream(

return new RetryWrapper<bool>.CallbackResult(
error: null,
shouldRetry: true,
shouldRetry: !lastDownloadResult.CredentialOperationTimedOut,
result: false,
shouldRecordFailure: lastDownloadResult?.ShouldRecordFailure ?? true);
}
Expand Down Expand Up @@ -368,6 +373,7 @@ private DownloadAttemptResult DoDownloadAndSaveObject(
// known. A default (zero) status means the result carried no HTTP response, so it is
// treated as "no status".
HttpStatusCode? httpStatusCode = null;
bool credentialOperationTimedOut = output.Result?.CredentialOperationTimedOut ?? false;
if (output.Result != null && output.Result.HttpStatusCodeResult != 0)
{
httpStatusCode = output.Result.HttpStatusCodeResult;
Expand All @@ -380,7 +386,8 @@ private DownloadAttemptResult DoDownloadAndSaveObject(
return new DownloadAttemptResult(
DownloadAndSaveObjectResult.Success,
httpStatusCode,
output.ShouldRecordFailure);
output.ShouldRecordFailure,
credentialOperationTimedOut);
}

if (output.Result.HttpStatusCodeResult == HttpStatusCode.NotFound)
Expand All @@ -389,14 +396,16 @@ private DownloadAttemptResult DoDownloadAndSaveObject(
return new DownloadAttemptResult(
DownloadAndSaveObjectResult.ObjectNotOnServer,
httpStatusCode,
output.ShouldRecordFailure);
output.ShouldRecordFailure,
credentialOperationTimedOut);
}
}

return new DownloadAttemptResult(
DownloadAndSaveObjectResult.Error,
httpStatusCode,
output.ShouldRecordFailure);
output.ShouldRecordFailure,
credentialOperationTimedOut);
}
}
}
Loading
Loading