Skip to content
This repository was archived by the owner on Mar 6, 2026. It is now read-only.

chore: Add warnings regarding consuming externally sourced credentials #1655

Merged
sai-sunder-s merged 7 commits into from
Jan 22, 2025
Merged

chore: Add warnings regarding consuming externally sourced credentials #1655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bce7db1
chore: Add warnings regarding consuming externally sourced credential…
sai-sunder-s Jan 16, 2025
a91b314
update syntax
sai-sunder-s Jan 16, 2025
ed2a6e9
remove in ADC
sai-sunder-s Jan 16, 2025
c2bfde6
period
sai-sunder-s Jan 16, 2025
230bcc1
make it warning
sai-sunder-s Jan 16, 2025
e391295
update warning syntax
sai-sunder-s Jan 16, 2025
cb9feae
update secret after rebase
sai-sunder-s Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions docs/user-guide.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,17 @@ that supports OpenID Connect (OIDC).
Obtaining credentials
---------------------

.. warning::
Important: If you accept a credential configuration (credential JSON/File/Stream)
from an external source for authentication to Google Cloud Platform, you must
validate it before providing it to any Google API or client library. Providing an
unvalidated credential configuration to Google APIs or libraries can compromise
the security of your systems and data. For more information, refer to
`Validate credential configurations from external sources`_.

.. _Validate credential configurations from external sources:
https://cloud.google.com/docs/authentication/external/externally-sourced-credentials

.. _application-default:

Application default credentials
Expand Down
22 changes: 22 additions & 0 deletions google/auth/_default.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,17 @@ def load_credentials_from_file(
user credentials, external account credentials, or impersonated service
account credentials.

.. warning::
Important: If you accept a credential configuration (credential JSON/File/Stream)
from an external source for authentication to Google Cloud Platform, you must
validate it before providing it to any Google API or client library. Providing an
unvalidated credential configuration to Google APIs or libraries can compromise
the security of your systems and data. For more information, refer to
`Validate credential configurations from external sources`_.

.. _Validate credential configurations from external sources:
https://cloud.google.com/docs/authentication/external/externally-sourced-credentials

Args:
filename (str): The full path to the credentials file.
scopes (Optional[Sequence[str]]): The list of scopes for the credentials. If
Expand Down Expand Up @@ -137,6 +148,17 @@ def load_credentials_from_dict(
user credentials, external account credentials, or impersonated service
account credentials.

.. warning::
Important: If you accept a credential configuration (credential JSON/File/Stream)
from an external source for authentication to Google Cloud Platform, you must
validate it before providing it to any Google API or client library. Providing an
unvalidated credential configuration to Google APIs or libraries can compromise
the security of your systems and data. For more information, refer to
`Validate credential configurations from external sources`_.

.. _Validate credential configurations from external sources:
https://cloud.google.com/docs/authentication/external/externally-sourced-credentials

Args:
info (Dict[str, Any]): A dict object containing the credentials
scopes (Optional[Sequence[str]]): The list of scopes for the credentials. If
Expand Down
Binary file modified system_tests/secrets.tar.enc
View file
Open in desktop
Binary file not shown.