AlinsRan commented on PR #13699: URL: https://github.com/apache/apisix/pull/13699#issuecomment-5030389664
Fixed on both this PR and the upstream apache/apisix#13699. The key is now `ngx.md5(service_account_json .. "\0" .. expire_early_secs .. "\0" .. max_ttl) .. "#" .. name`: - a 128-bit digest instead of the 32-bit CRC, so distinct credentials no longer collide onto the wrong cached token; - `expire_early_secs` and `max_ttl` are part of the key, so identical credentials under different TTL policies get separate entries and the second policy is no longer bypassed; - the raw JSON still never enters the key or the log (only the digest does). Used `ngx.md5` rather than SHA-256 to follow the existing cache-key convention in the codebase (e.g. `graphql-proxy-cache`); this is a non-adversarial cache key, and 128 bits removes the accidental-collision risk the CRC had. Happy to switch to SHA-256 if you prefer. Added a regression test (vertex-ai TEST 13): same name and credentials with different `max_ttl` must not share a token. Verified discriminating — with the old CRC key it reports `calls=1 distinct=false` (aliased), with the fix `calls=2 distinct=true cachehit=true`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
