Skip to content

fix(Auth): retain expiration in FileSystemCacheItemPool and return null in CacheTrait - #9687

Open
cy-yun wants to merge 1 commit into
mainfrom
fix/auth-filesystem-cache-expiration
Open

cy-yun wants to merge 1 commit into
mainfrom
fix/auth-filesystem-cache-expiration

Conversation

@cy-yun

@cy-yun cy-yun commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Fixes #9669

Problem

In FileSystemCacheItemPool::save(), the pool called serialize($item->get()). This discarded all expiration metadata and cache item status on save. When getItem() was subsequently called, it instantiated a new TypedItem($key) and called $item->set(...), setting $isHit to true and clearing any expiration. As a result, items never expired in the file cache, leading to stale authentication tokens being reused indefinitely. Additionally, in CacheTrait::getCachedValue(), when $cacheItem->isHit() was false, the method implicitly fell off without an explicit return statement.

Solution

  1. FileSystemCacheItemPool::save(): Directly serialize $item (serialize($item)) so expiration and cache metadata are retained.
  2. FileSystemCacheItemPool::getItem(): Unserialize the data; if it is an instance of CacheItemInterface, return it directly. For backward compatibility with legacy cache files on disk containing raw serialized values, fallback to creating a new TypedItem($key) and setting the value.
  3. CacheTrait::getCachedValue(): Add an explicit return null; at the end of the method when cache items are missed or expired.

Verification

  • Added testSaveAndGetExpiredItem in FileSystemCacheItemPoolTest verifying that expired cache items return false for isHit() and null for get().
  • Added testGetItemLegacyCacheFile in FileSystemCacheItemPoolTest verifying backward compatibility with legacy serialized cache files.
  • Added testFailsPullFromCacheWhenItemIsNotHit in CacheTraitTest verifying explicit null return on cache miss.
  • Ran test suite: HOME=/tmp vendor/bin/phpunit Auth/tests/Cache/FileSystemCacheItemPoolTest.php (passed).
  • Ran test suite: HOME=/tmp vendor/bin/phpunit Auth/tests/CacheTraitTest.php (passed).
  • Ran CS Fixer: vendor/bin/php-tools cs-fixer googleapis/google-cloud-php --ref HEAD (0 files that can be fixed).

@cy-yun
cy-yun requested a review from a team as a code owner September 14, 2026 20:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Auth] FileSystemCacheItemPool implementation is broken, it loses expiration information and causes stale auth token usage

2 participants