fix(auth): restore transportFactory upon deserialization in InternalAwsSecurityCredentialsSupplier - #14340
Merged
Merged
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request implements serialization and deserialization support for the InternalAwsSecurityCredentialsSupplier class by storing and restoring the HttpTransportFactory class name. It also adds unit tests to verify that credentials and region retrieval, as well as token refreshing, work correctly after deserialization. The review feedback highlights a potential compatibility issue where serializing the internal class name of the default fallback transport factory could lead to ClassNotFoundException in future versions if that class is renamed or refactored. It is recommended to set transportFactoryClassName to null when the default factory is used.
lqiu96
force-pushed
the
fix-aws-credentials-deserialization-14050
branch
from
September 9, 2026 22:09
193536d to
5e04216
Compare
lqiu96
marked this pull request as ready for review
September 9, 2026 22:21
…wsSecurityCredentialsSupplier Fixes #14050 Fixes #1538 In InternalAwsSecurityCredentialsSupplier, transportFactory is marked transient but no transportFactoryClassName was retained and no readObject was defined. Consequently, after Java deserialization (common in distributed frameworks like Apache Flink and Apache Spark), transportFactory is null. When deserialized AwsCredentials attempts to refresh its token, a NullPointerException is thrown when retrieving AWS security credentials or region from the metadata service. This change: 1. Records transportFactoryClassName during construction. 2. Implements readObject to restore transportFactory using OAuth2Credentials.newInstance(transportFactoryClassName). 3. Adds reproduction and serialization unit tests verifying credentials and region retrieval after deserialization, including token refresh in AwsCredentials.
lqiu96
force-pushed
the
fix-aws-credentials-deserialization-14050
branch
from
September 9, 2026 22:26
5e04216 to
78c0f32
Compare
whowes
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #14050
Part of #12580
In InternalAwsSecurityCredentialsSupplier, transportFactory is marked transient but no transportFactoryClassName was retained and no readObject was defined. Consequently, after Java deserialization (common in distributed frameworks like Apache Flink and Apache Spark), transportFactory is null. When deserialized AwsCredentials attempts to refresh its token, a NullPointerException is thrown when retrieving AWS security credentials or region from the metadata service.
This change: