Skip to content

Hotfix: Key Vault challenge cache validation (secrets 4.11.2) #48741

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ROHIT SINGHAL (rohitsinghal4u) merged 1 commit into from
Aug 25, 2026
Merged

Hotfix: Key Vault challenge cache validation (secrets 4.11.2) #48741

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
# Release History

## 4.11.2 (2026-08-25)

### Bugs Fixed

- Fixed the challenge authentication policy to cache the authentication challenge only after the challenge resource is verified, so that a rejected challenge is not cached and reused by subsequent requests.

## 4.11.1 (2026-08-12)

### Bugs Fixed
Expand Down
2 changes: 2 additions & 0 deletions ...ault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_challenge_auth_policy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,8 @@ async def on_challenge(self, request: PipelineRequest, response: PipelineRespons
"See https://aka.ms/azsdk/blog/vault-uri for more information."
)

ChallengeCache.set_challenge_for_url(request.http_request.url, challenge)

# If we stashed the original request in on_request, use it now to send along the original body content
request_copy = request.context.get(_REQUEST_COPY_KEY)
if request_copy:
Expand Down
5 changes: 3 additions & 2 deletions sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/challenge_auth_policy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ def _has_claims(challenge: str) -> bool:


def _update_challenge(request: PipelineRequest, challenger: PipelineResponse) -> HttpChallenge:
"""Parse challenge from a challenge response, cache it, and return it.
"""Parse challenge from a challenge response and return it.

:param request: The pipeline request that prompted the challenge response.
:type request: ~azure.core.pipeline.PipelineRequest
Expand All @@ -80,7 +80,6 @@ def _update_challenge(request: PipelineRequest, challenger: PipelineResponse) ->
challenger.http_response.headers.get("WWW-Authenticate"),
response_headers=challenger.http_response.headers,
)
ChallengeCache.set_challenge_for_url(request.http_request.url, challenge)
return challenge


Expand Down Expand Up @@ -234,6 +233,8 @@ def on_challenge(self, request: PipelineRequest, response: PipelineResponse) ->
"See https://aka.ms/azsdk/blog/vault-uri for more information."
)

ChallengeCache.set_challenge_for_url(request.http_request.url, challenge)

# If we stashed the original request in on_request, use it now to send along the original body content
request_copy = request.context.get(_REQUEST_COPY_KEY)
if request_copy:
Expand Down
2 changes: 1 addition & 1 deletion sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@
# Licensed under the MIT License.
# ------------------------------------

VERSION = "4.11.1"
VERSION = "4.11.2"
Loading