User-Agent header missing in Release builds#283
Merged
Conversation
SDKVersion.userAgent is populated as a side effect of evaluating the lazy 'static let' registration in each Version+*.swift. Every dereference site is currently spelled 'assert(SDKVersion.X != nil)' — but Swift's assert(_:) takes its condition as @autoclosure, which the optimizer strips in -O builds. In Release builds the lazies never fire, SDKVersion._userAgent stays the empty string, and every outgoing request goes out with an empty User-Agent header. Replace the 19 'assert(SDKVersion.X != nil)' triggers across 13 files with '_ = SDKVersion.X' so the lazy registration fires regardless of build configuration. Same registration mechanism — only the trigger moves out of an @autoclosure. Adds Tests/AuthFoundationTests/SDKVersionRegistrationTests.swift to pin the contract. Verified to fail in 'swift test -c release' before this change and pass after.
AlexNachbaur
changed the title
FeiChen-okta
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SDKVersion.userAgentis populated as a side effect of evaluating the lazystatic letregistration in eachVersion+*.swift. Every dereference site was spelledassert(SDKVersion.X != nil)— but Swift'sassert(_:)takes its condition as@autoclosure, which the optimizer strips entirely in-O(Release) builds. In Release/TestFlight builds the lazies never fire,SDKVersion._userAgentstays the empty string, and every outgoing SDK request goes out with an emptyUser-Agentheader.This reproduces exactly as reported: present in Debug, missing in Release. For at least one customer (MGM Resorts), the header-less traffic is being flagged as bot activity by their WAF.
Replaces the 19
assert(SDKVersion.X != nil)triggers across 13 files with_ = SDKVersion.X, so the lazy registration fires unconditionally regardless of build configuration. Same registration mechanism — only the trigger moves out of an@autoclosure.Adds
Tests/AuthFoundationTests/SDKVersionRegistrationTests.swiftto pin the contract. Verified locally: fails on unmodifiedmasterunderswift test -c release, passes after this change. Full suite (395 tests) passes in both Debug and Release after the fix.Credit
This is a cherry-pick of the fix and diagnosis from @RicardoKoch's #277, with a follow-up commit trimming the new test's doc comment to match this repo's style. Opening as a fresh PR against current
master(superseding #277) since that PR's CI never ran and it needed review from an Okta maintainer.Fixes #254.