[Storage] Create Session Support for GET Requests by weirongw23-msft · Pull Request #47264 · Azure/azure-sdk-for-python

weirongw23-msft · 2026-06-01T16:44:09Z

No description provided.

Copilot

Pull request overview

This PR introduces opt-in “session-based” authentication for eligible GET blob requests (notably downloads) by adding a pipeline policy that can acquire/cache a short-lived session credential per container and use it to sign subsequent GET requests. It also adds the generated CreateSession REST operation/models and a new recorded test covering session behavior.

Changes:

Added StorageSessionPolicy + container-scoped session cache, and plumbed use_session=True into the sync pipeline creation path.
Added generated create_session operation + models/enums to support the service’s session creation API.
Added a recorded test and updated proxy sanitizers for session credentials.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
sdk/storage/azure-storage-blob/azure/storage/blob/_shared/policies.py	Adds sync session auth policy + cache and request signing logic.
sdk/storage/azure-storage-blob/azure/storage/blob/_shared/base_client.py	Adds `use_session` kwarg handling and wires `StorageSessionPolicy` into the sync pipeline.
sdk/storage/azure-storage-blob/azure/storage/blob/_shared/policies_async.py	Introduces an async session policy stub (currently unimplemented).
sdk/storage/azure-storage-blob/azure/storage/blob/_generated/operations/_container_operations.py	Adds generated `create_session` request builder + operation.
sdk/storage/azure-storage-blob/azure/storage/blob/_generated/aio/operations/_container_operations.py	Adds generated async `create_session` operation.
sdk/storage/azure-storage-blob/azure/storage/blob/_generated/models/_models_py3.py	Adds generated session models: `CreateSessionConfiguration`, `CreateSessionResponse`, `SessionCredentials`.
sdk/storage/azure-storage-blob/azure/storage/blob/_generated/models/_azure_blob_storage_enums.py	Adds generated enum `AuthenticationType`.
sdk/storage/azure-storage-blob/azure/storage/blob/_generated/models/init.py	Re-exports new generated models/enums.
sdk/storage/azure-storage-blob/azure/apiview-properties.json	Updates API view surface list for new types/ops.
sdk/storage/azure-storage-blob/tests/conftest.py	Adds test-proxy sanitizers for session token/key.
sdk/storage/azure-storage-blob/tests/test_container.py	Adds recorded test validating bearer-vs-session auth behavior and per-container session usage.
sdk/storage/azure-storage-blob/CHANGELOG.md	Documents the new opt-in session authentication feature.

jalauzon-msft

Some comments on the sync policy itself, did not look at much else yet

jalauzon-msft · 2026-06-02T23:54:58Z

+        if http_request.method != "GET":
+            return False
+        parsed = urlparse(http_request.url)
+        segments = [s for s in parsed.path.split("/") if s]


This is more of a meta point for URL parsing in the PR as a whole but I'm leaving here as an example. Azurite/emulators use URLs like 127.0.0.1/account/container which would break all the container parsing logic. Not sure if we care about that (probably eventually we will need to)

jalauzon-msft · 2026-06-04T00:26:19Z

+                StorageSessionPolicy(
+                    account_name=self.account_name,
+                    session_client_factory=_session_client_factory,
+                    use_session=True,


This is always passed as True? That probably means we don't need it in the policy and if the policy is present, it does its thing?

The original design I had in mind was to add this policy blindly after StorageBearerTokenPolicy, and depending on the user passed in we just pass use_session thru. Then I realized there are some validation for us to do and that includes creating the session client factory (not worth creating if use_session is not enabled).

What I think is the best approach here is to replace the explicit use_session flag/kwarg with the policy's mere presence in the pipeline as the enablement signal—so if the StorageSessionPolicy is wired in, session auth is on—and add a runtime _enabled switch that flips off automatically when the service responds with StorageErrorCode.FeatureNotEnabled, so the SDK stops attempting (and retrying) session auth on accounts that don't support it.

jalauzon-msft · 2026-06-04T00:51:19Z

+        captured = {}
+
+        def make_capture(label):
+            def _hook(response):


Why hook inside a hook? You shouldn't need that. You may need to declare captured as nonlocal here though.

It's a way for the hook to distinguish between requests we're making. For example, an upload should use bearer token and download might use sessions. The label helps distinguish that. We still make the checks through captured[label]. I don't think we have to make it nonlocal if we are mutating captured in place.

jalauzon-msft · 2026-06-04T00:54:18Z

+            for p in getattr(pipeline, "_impl_policies", []):
+                if type(p).__name__ == "StorageSessionPolicy":
+                    return p
+            raise AssertionError("StorageSessionPolicy not found on the pipeline")


All these inline functions could be helpers, so they aren't duplicated? Even could be shared across sync and async. With the exception of maybe make_capture since it needs a local... but maybe there is something for that too.

jalauzon-msft · 2026-06-04T00:55:09Z

+            assert auth.startswith("Session ")
+            return auth[len("Session ") :].split(":", 1)[0]
+
+        def find_session_policy(pipeline):


This is pretty jank, but I'll allow it for now :D

jalauzon-msft · 2026-06-04T20:42:03Z

+        )
+
+    def invalidate(self, container_name: str, session_token: Optional[str] = None) -> None:
+        if session_token is None:


I don't think we need this if. It could remove a session that another thread put there.

weirongw23-msft added 6 commits May 27, 2026 07:41

Generated code

2058c9f

Redact sensitive session info for recorded tests / changelogs

be05b4d

Rewrite

5eeb392

WIP

a4b0379

GG

49ad7dc

Removed comments

19b3f75

weirongw23-msft marked this pull request as ready for review June 1, 2026 16:44

Copilot AI review requested due to automatic review settings June 1, 2026 16:44

weirongw23-msft requested review from annatisch, jalauzon-msft and vincenttran-msft as code owners June 1, 2026 16:44

Copilot started reviewing on behalf of weirongw23-msft June 1, 2026 16:44 View session

github-actions Bot added the Storage Storage Service (Queues, Blobs, Files) label Jun 1, 2026

More stuff

4a8ef92

Copilot AI reviewed Jun 1, 2026

View reviewed changes

weirongw23-msft added 8 commits June 2, 2026 12:31

More tests

75744d1

Format

75a2bd7

Added one more test

0eb242a

One more assert

b7c4ef9

API changes

48faaec

BOOM BOOM

a63e45e

Async

24ffd97

Async tests

1e9171b

jalauzon-msft reviewed Jun 3, 2026

View reviewed changes

weirongw23-msft added 5 commits June 3, 2026 13:27

Feature not enabled

c7c77af

Feedback

6a1492d

Got rid of broad except

d86b2d9

Merge branch 'main' into weirongw23/sessions-private

8c66a4d

black

27003eb

weirongw23-msft requested a review from jalauzon-msft June 3, 2026 22:46

jalauzon-msft reviewed Jun 4, 2026

View reviewed changes

weirongw23-msft added 7 commits June 4, 2026 02:29

Rename

e13d8d5

More feedback

47dfd8c

Passing pipeline directly

9f3796c

Removed the use_session kwarg in policies

edb67d3

Actually retry on 401

8cce524

Factored out helper methods in test files

e5c7ee7

Merge branch 'main' into weirongw23/sessions-private

d752e8b

weirongw23-msft changed the base branch from main to storage/sessions-private June 4, 2026 19:25

weirongw23-msft added 2 commits June 4, 2026 16:30

Refactoring

ffe44db

More refactoring

7f9d2c0

jalauzon-msft reviewed Jun 4, 2026

View reviewed changes

weirongw23-msft added 2 commits June 4, 2026 17:18

invalidate update

e247fe7

Inline resolve session

5eacfb8

weirongw23-msft requested a review from jalauzon-msft June 4, 2026 21:38

jalauzon-msft approved these changes Jun 5, 2026

View reviewed changes

weirongw23-msft merged commit 0c5537d into Azure:storage/sessions-private Jun 5, 2026
3 checks passed

weirongw23-msft deleted the weirongw23/sessions-private branch June 5, 2026 03:37

Conversation

weirongw23-msft commented Jun 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jalauzon-msft left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants