0

Since a week I'm facing a weird bug on my python server. Right now it is running on Requests version 2.23.0 without issue.

Because of vulnerability issue I'd like to bump the Requests version to the 2.26.0.

My servers runs ok until I try to run a piece of code like that:

import requests
from firebase_admin import auth

bearer_token = requests.headers['X-Bearer-Token'] # Usually there is the word `Bearer`, consider we remove it.
decoded_token = auth.verify_id_token(bearer_token, check_revoked=False)

This piece of code will raise:

RecursionError: maximum recursion depth exceeded

Full error:

Traceback (most recent call last):
  File "./project/handlers/users.py", line 106, in get_user
    decoded_token = auth.verify_id_token(a, check_revoked=False)
  File "./project/venv/lib/python3.6/site-packages/firebase_admin/auth.py", line 220, in verify_id_token
    return client.verify_id_token(id_token, check_revoked=check_revoked)
  File "./project/venv/lib/python3.6/site-packages/firebase_admin/_auth_client.py", line 127, in verify_id_token
    verified_claims = self._token_verifier.verify_id_token(id_token)
  File "./project/venv/lib/python3.6/site-packages/firebase_admin/_token_gen.py", line 293, in verify_id_token
    return self.id_token_verifier.verify(id_token, self.request)
  File "./project/venv/lib/python3.6/site-packages/firebase_admin/_token_gen.py", line 396, in verify
    certs_url=self.cert_url)
  File "./project/venv/lib/python3.6/site-packages/google/oauth2/id_token.py", line 124, in verify_token
    certs = _fetch_certs(request, certs_url)
  File "./project/venv/lib/python3.6/site-packages/google/oauth2/id_token.py", line 98, in _fetch_certs
    response = request(certs_url, method="GET")
  File "./project/venv/lib/python3.6/site-packages/firebase_admin/_token_gen.py", line 266, in __call__
    url, method=method, body=body, headers=headers, timeout=timeout, **kwargs)
  File "./project/venv/lib/python3.6/site-packages/google/auth/transport/requests.py", line 184, in __call__
    method, url, data=body, headers=headers, timeout=timeout, **kwargs
  File "./project/venv/lib/python3.6/site-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "./project/venv/lib/python3.6/site-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "./project/venv/lib/python3.6/site-packages/cachecontrol/adapter.py", line 57, in send
    resp = super(CacheControlAdapter, self).send(request, **kw)
  File "./project/venv/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "./project/venv/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "./project/venv/lib/python3.6/site-packages/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "./project/venv/lib/python3.6/site-packages/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "./project/venv/lib/python3.6/site-packages/urllib3/connection.py", line 332, in connect
    cert_reqs=resolve_cert_reqs(self.cert_reqs),
  File "./project/venv/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 281, in create_urllib3_context
    context.options |= options
  File "/usr/local/lib/python3.6/ssl.py", line 465, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  File "/usr/local/lib/python3.6/ssl.py", line 465, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  File "/usr/local/lib/python3.6/ssl.py", line 465, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  [Previous line repeated 963 more times]
  File "/usr/local/lib/python3.6/ssl.py", line 463, in options
    @options.setter
RecursionError: maximum recursion depth exceeded

Librairies:

  • requests = ^2.24.0
  • firebase-admin = ^5.0.0
  • I also tried with Python 3.8.12 and both Requests versions 2.23.0 and 2.26.0 Same error, it is raised while calling `self.id_token_verifier.verify(id_token, self.request)` from the class TokenVerifier from _token_gen.py file. (Firebase_admin sdk) – Gabriel Blondeau Jan 06 '22 at 10:38

1 Answers1

0

I solved it by removing the Eventlet Monkey patch.

eventlet.monkey_patch()