membphis commented on PR #13699: URL: https://github.com/apache/apisix/pull/13699#issuecomment-5029480220
[P2] GCP token cache key can alias different credentials and TTL policies The new cache key uses `ngx.crc32_long(service_account_json) .. "#" .. name`. Because it relies on a 32-bit CRC and omits `expire_early_secs` and `max_ttl`, separate configurations can alias: different credentials may reuse the wrong cached access token after a collision, while identical credentials and names with different TTL policies can bypass the latter policy. Please use a collision-resistant digest of the resolved credentials and all fields that affect cache reuse, without logging plaintext secrets, and add coverage for same-name configurations with different TTL policies. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
