Repository navigation
fix: respect explicit WebSocket Authorization with workload identity - #1309
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Reviewed 1184e80 with coordinator and independent static passes.
Explicit WebSocket Authorization bypasses workload token exchange and managed-token invalidation. Managed credential acquisition and 401 invalidation retain their existing path.
Hosted CI: {'SUCCESS': 14}. No candidate code or tests were executed locally.
When a WebSocket connection supplies an explicit Authorization header, the Java
client still asks its configured workload identity provider for a token. An
otherwise unnecessary token exchange can then prevent the connection from
opening. A rejected connection can also invalidate a managed token even though
the caller supplied the rejected header.
Only obtain and invalidate a managed token when workload identity supplied that
connection's Authorization header. Keep the existing refresh behavior when the
client uses managed authentication. Tests cover caller headers across Responses,
Realtime and Live connections, plus both explicit-header and managed-token
handshake failures.
Validation: all 9 tests in
WebSocketWorkloadIdentityTestpass on the publicbase;
:openai-java-core:lintKotlinandgit diff --checkpass.