Fix extra header duplication on retry by ypfaff · Pull Request #6204 · git-lfs/git-lfs · GitHub
Skip to content

Fix extra header duplication on retry - #6204

Merged
chrisd8088 merged 2 commits into
git-lfs:mainfrom
ypfaff:fix/6202-infinite-auth-loop
Apr 5, 2026
Merged

chrisd8088 merged 2 commits into
git-lfs:mainfrom
ypfaff:fix/6202-infinite-auth-loop

Conversation

@ypfaff

@ypfaff ypfaff commented Feb 9, 2026 •

Copy link
Copy Markdown
Contributor

Fixes the header duplication issue reported in #6202 by adding a deduplication check in ExtraHeadersFor before appending headers. This prevents values like Authorization: Bearer x, Bearer x when the same *http.Request is reused during auth retries.

Rebased on top of #6018.

Fixes #6202

@ypfaff
ypfaff requested a review from a team as a code owner February 9, 2026 21:14
@chrisd8088

Copy link
Copy Markdown
Member

@chrisd8088

Copy link
Copy Markdown
Member

Just FYI, I updated PR #6018 and am now just waiting for a second review before merging it.

If you feel like rebasing and refactoring this PR on top of PR #6018's branch, please go ahead, and as you should then be able to focus this PR on just the header duplication issue.

@chrisd8088 chrisd8088 added the bug label Mar 12, 2026
@ypfaff
ypfaff force-pushed the fix/6202-infinite-auth-loop branch from faa2070 to c54b4a2 Compare March 15, 2026 12:06
@ypfaff ypfaff changed the title Fix infinite 401 loop due to header duplication and broken retry logic Fix extra header duplication on retry Mar 15, 2026
@ypfaff

ypfaff commented Mar 15, 2026

Copy link
Copy Markdown
Contributor Author

@chrisd8088 chrisd8088 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks again for this PR, and for your patience while we get PR #6018 finalized!

I looked at the last commit in this PR and it looks very good! Thanks especially for writing a test. I made a couple of suggestions only, so please take a look whenever you get a chance.

Thanks again very much for your help!

Comment thread lfshttp/client.go Outdated
Comment thread lfshttp/client_test.go
Previously, `ExtraHeadersFor` blindly appended configured extra headers to the request. If a request was retried (reusing the same *http.Request object), these headers would be duplicated (e.g., "Authorization: Bearer x, Bearer x"), resulting in a malformed header and subsequent 401 errors.

Relates to git-lfs#6202
@ypfaff
ypfaff force-pushed the fix/6202-infinite-auth-loop branch from c54b4a2 to e3e3a49 Compare April 2, 2026 11:20
@ypfaff
ypfaff requested a review from chrisd8088 April 2, 2026 11:26

@chrisd8088 chrisd8088 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great, thank you!

@chrisd8088
chrisd8088 merged commit dd37140 into git-lfs:main Apr 5, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ExtraHeadersFor duplicates http.extraHeader on auth retry, causing infinite 401 loop

2 participants