Skip to content

fix(rab): run async background boundary refresh on detached session#17441

Open
nbayati wants to merge 3 commits into
googleapis:mainfrom
nbayati:fix-async-rab-transport
Open

fix(rab): run async background boundary refresh on detached session#17441
nbayati wants to merge 3 commits into
googleapis:mainfrom
nbayati:fix-async-rab-transport

Conversation

@nbayati

@nbayati nbayati commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

When AuthorizedSession.request() makes an API call, it runs inside a temporary aiohttp ClientSession block. If our background Regional Access Boundary (RAB) refresh worker naively shares this exact same session, a fast primary call (like an instant 401/403 or a quick CRM check) will exit its block and close the active socket mid-flight. This causes the background worker to silently fail with "RuntimeError: Session is closed" and forces the RAB manager into a 15-minute cooldown.

This commit solves the race condition by giving the background worker its own separate transport session:

  • Added a clone() method to async Request adapters to create a fresh, independent ClientSession sharing the exact same corporate proxy and trace configurations.
  • Updated _AsyncRegionalAccessBoundaryRefreshManager to unwrap any partial timeouts, clone the request, and run the background lookup on that detached session.
  • Added a finally block to make sure the detached session gets properly closed when the lookup settles to prevent socket leaks.

To recreate the bug consistently and verify our fix, I used a reproduction script (paste/6312404345552896) that simulates a fast main API call (like an instant 401/403 Edge drop or highly optimized endpoint) by cancelling the primary request 30ms after it is dispatched.

nbayati added 2 commits June 11, 2026 17:42
Prevents fast primary API calls from closing the underlying aiohttp session
mid-flight and breaking background Regional Access Boundary (RAB) lookups.
Adds a clone() method to async Request adapters to run background refreshes
on an independent session, closing it cleanly when finished.
@nbayati nbayati requested review from a team as code owners June 12, 2026 02:25

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces request cloning for asynchronous regional access boundary refreshes to prevent race conditions where a foreground call closes a shared session. It adds a clone() method to the aiohttp request adapters and ensures that cloned requests are cleanly closed. The review feedback recommends ensuring the inspect module is imported and improving the exception handling when closing the cloned request by catching general exceptions and logging a warning instead of silently ignoring specific errors.

Comment thread packages/google-auth/google/auth/_regional_access_boundary_utils.py Outdated
@nbayati nbayati changed the title Fix async rab transport fix(rab): run async background boundary refresh on detached session Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant