Repository navigation
Report token endpoint errors as connector errors - #356
Merged
Merged
Conversation
Requests to the token endpoint are sent from the authentication package, and their failures need to name the token URL without its query string, which can hold credentials, like failures of requests to the API and to the spec location do.
When the token endpoint failed, queries failed with exceptions of the HTTP client, like UnexpectedResponseException or OAuth2TokenException, which Trino reports as generic internal errors, without the request context that failures of requests to the API include. The exception type also depended on which of the two token providers got the token. Error responses are reported with the status, but without the response body, because token endpoints can repeat the client secret or the password sent in the token request, and the token URL is named without its query string for the same reason. Retries of token requests done by the providers don't change, so only their last failure is reported.
Both token providers need to report error responses, connection failures, and failures of refreshing a rejected token with connector error codes, without leaking the client secret, the password, or the response body into the error.
nineinchnick
force-pushed
the
token-endpoint-errors
branch
from
October 24, 2026 15:59
8e52be9 to
7e20103
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the token endpoint failed, queries failed with exceptions of the HTTP client, like
UnexpectedResponseExceptionorOAuth2TokenException, which Trino reports as generic internal errors, without the request context that failures of requests to the API include. The exception type also depended on which of the two token providers from #337 got the token.Error responses are now reported as
OPENAPI_HTTP_ERRORwith the status, and transport errors asOPENAPI_CONNECTION_ERROR, for both providers, for getting and for refreshing a token. The response body is never included, because token endpoints can repeat the client secret or the password sent in the token request, and the token URL is named without its query string for the same reason. Retries of token requests done by Airlift's provider don't change, so only their last failure is reported.Making
OpenApiClient.withoutQuerypublic is a separate commit, because the token providers are in another package.The test of #350 for a 401 token response without a challenge now expects
OPENAPI_HTTP_ERRORinstead of the Airlift exception types.Fixes #351