Repository navigation
Authenticated GET cache is not isolated by token #241
Description
gh() caches GET responses by URL without distinguishing authentication tokens. This causes token-dependent GET responses to be reused after the caller switches tokens, potentially returning data associated with the previous token.
valid_token <- gh::gh_token()
invalid_token <- paste0("ghp_", strrep("x", 36))
first <- gh::gh("/user", .token = valid_token)
second <- gh::gh("/user", .token = invalid_token)
identical(first$login, second$login)
#> [1] TRUE
# Disabling the cache produces the expected authentication error.
options(gh_cache = FALSE)
gh::gh("/user", .token = invalid_token)
#> Error: GitHub API error (401): Bad credentialsExpected behavior: authenticated responses should never be reused across tokens. GitHub responses use Vary: Authorization, so the cache should account for that header, partition entries by authentication context, or avoid caching authenticated requests.
Observed with gh 1.6.1.
If this makes more sense as an upstream issue with httr2 I'm happy to move it there.
Activity
gaborcsardi commentedon Sep 2, 2026
@rundel If you want a quick release, please confirm that this works for you and I'll make a release.
rundel commentedon Sep 2, 2026
I don't need a quick release - I opened this before I opted to shut off cacheing entirely in ghclass. It was the cause of a couple of weird bugs we were seeing (what I get for not paying attention to the gh news file) but the crude approach was pushed for our latest release so we're all good for the moment.
rundel commentedon Sep 2, 2026
Can confirm the fix works with the pre-cache-nuke version of ghclass