Skip to content

api/proxy: preserve active connections after auth failure - #6778

Draft
vigneshakaviki wants to merge 1 commit into
hashicorp:mainfrom
vigneshakaviki:fix/6774-preserve-active-connections
Draft

api/proxy: preserve active connections after auth failure#6778
vigneshakaviki wants to merge 1 commit into
hashicorp:mainfrom
vigneshakaviki:fix/6774-preserve-active-connections

Conversation

@vigneshakaviki

Copy link
Copy Markdown

Description

Preserve active proxy connections when a new connection fails authorization. The authorization failure still closes the listener so no further connections can start, but it no longer cancels the shared context used by already-active connections.

Security-control impact: none. Authorization behavior remains unchanged; rejected connections still fail and stop the listener.

Closes #6774

Testing

  • go test ./proxy -run ^TestStartAuthorizationFailureKeepsExistingConnections$ -count=20
  • go test -race ./proxy -run ^TestStartAuthorizationFailureKeepsExistingConnections$ -count=1
  • go test ./... -count=1 (from api/)
  • go vet ./... (from api/)
  • LINT_DIFF_BRANCH=origin/main make lint-diff

PCI review checklist

  • I have documented a clear reason for, and description of, the change I am making.
  • If applicable, I have documented a plan to revert these changes if they require more than reverting the pull request.
  • If applicable, I have documented the impact of any changes to security controls.
    Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

An authorization rejection should stop new connections without canceling the shared proxy context used by connections that are already active.
@github-actions github-actions Bot added the api label Aug 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Start() cancels context for "unable to authorize connection", killing all active connections on the session

1 participant