Skip to content

fix(oauth2): Prevent concurrent token exchanges #95404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

seer-by-sentry[bot]
Copy link
Contributor

Fixes SENTRY-46A9. The issue was that: Authorization code reuse due to multiple callback attempts causes Google to reject token exchange with "Malformed auth code."

  • Add a lock around the token exchange process to prevent concurrent exchanges using the same authorization code.
  • This prevents issues where multiple requests are made to exchange the same code, which can lead to errors or unexpected behavior.

This fix was generated by Seer in Sentry, triggered by rahul.chhabria@sentry.io. 👁️ Run ID: 332052

Not quite right? Click here to continue debugging with Seer.

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

@github-actions github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jul 13, 2025
Copy link

codecov bot commented Jul 13, 2025

❌ 77 Tests Failed:

Tests completed Failed Passed Skipped
27192 77 27115 236
View the top 3 failed test(s) by shortest run time
tests.sentry.identity.test_oauth2.OAuth2CallbackViewTest::test_api_error
Stack Traces | 0.044s run time
#x1B[1m#x1B[.../sentry/identity/test_oauth2.py#x1B[0m:153: in test_api_error
    result = self.view.exchange_token(self.request, pipeline, code)
#x1B[1m#x1B[.../sentry/identity/oauth2.py#x1B[0m:298: in exchange_token
    lock = Lock(
#x1B[1m#x1B[31mE   TypeError: Lock.__init__() got an unexpected keyword argument 'name'#x1B[0m
tests.sentry.identity.test_oauth2.OAuth2CallbackViewTest::test_connection_error
Stack Traces | 0.044s run time
#x1B[1m#x1B[.../sentry/identity/test_oauth2.py#x1B[0m:122: in test_connection_error
    result = self.view.exchange_token(self.request, pipeline, code)
#x1B[1m#x1B[.../sentry/identity/oauth2.py#x1B[0m:298: in exchange_token
    lock = Lock(
#x1B[1m#x1B[31mE   TypeError: Lock.__init__() got an unexpected keyword argument 'name'#x1B[0m
tests.sentry.identity.test_oauth2.OAuth2CallbackViewTest::test_exchange_token_success_customer_domains
Stack Traces | 0.046s run time
#x1B[1m#x1B[.../sentry/identity/test_oauth2.py#x1B[0m:77: in test_exchange_token_success_customer_domains
    result = self.view.exchange_token(self.request, pipeline, code)
#x1B[1m#x1B[.../sentry/identity/oauth2.py#x1B[0m:298: in exchange_token
    lock = Lock(
#x1B[1m#x1B[31mE   TypeError: Lock.__init__() got an unexpected keyword argument 'name'#x1B[0m

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Scope: Backend Automatically applied to PRs that change backend components
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants