feat: Deprecate unsafe credential loading methods and options (Windy Eagle Mitigation) by robertvoinescu-work · Pull Request #3043 · googleapis/google-api-dotnet-client

robertvoinescu-work · 2025-09-15T22:18:03Z

Mitigating the "Windy Eagle" Credential Vulnerability

Services accepting external credential configurations with our auth libraries are vulnerable to malicious configurations that allow an attacker to exfiltrate data. This critical vulnerability exposes services and their host machines to data and token theft, undermining our security posture. This pull request mitigates the risk by deprecating unsafe loading methods and introducing a strict CredentialFactory that requires developers to explicitly define the expected credential type. Adopting this new pattern closes the credential exfiltration attack vector and provides a clear, secure standard for all developers.

Key Changes

New CredentialFactory: A secure, type-safe way to create credentials.
Deprecated Unsafe Methods: FromJson, FromFile, FromStream, and FromJsonParameters are now obsolete.
Refactored Internals: All internal code and tests now use the new CredentialFactory.

Src/Support/Google.Apis.Auth/OAuth2/IGoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

Src/Support/Google.Apis.Auth.Tests/OAuth2/GoogleCredentialTests.cs

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

Src/Support/Google.Apis.Auth/OAuth2/ExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

amanda-tarafa

Mostly name changes and a little bit more of simplification. Thanks!

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

Src/Support/Google.Apis.Auth/OAuth2/IGoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/UserCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/UrlSourcedExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/ServiceAccountCredential.cs

amanda-tarafa

See comment on removing duplicate methods.

amanda-tarafa

A few more tweaks but looking great.

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.IntegrationTests/Utils/Helper.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/DefaultCredentialProvider.cs

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

Src/Support/Google.Apis.Auth/OAuth2/UrlSourcedExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/ProgrammaticExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/AwsExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/ExternalAccountCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

amanda-tarafa

LGTM, just a few styling nits.

amanda-tarafa · 2025-10-03T20:05:54Z

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

+        JsonCredentialParameters credentialParameters;
+        try
+        {
+            credentialParameters = await NewtonsoftJsonSerializer.Instance.DeserializeAsync<JsonCredentialParameters>(stream, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception e)
+        {
+            throw new InvalidOperationException("Error deserializing JSON credential data.", e);
+        }
+
+        return FromJsonParameters<T>(credentialParameters);


Suggested change

JsonCredentialParameters credentialParameters;

try

{

credentialParameters = await NewtonsoftJsonSerializer.Instance.DeserializeAsync<JsonCredentialParameters>(stream, cancellationToken).ConfigureAwait(false);

}

catch (Exception e)

{

throw new InvalidOperationException("Error deserializing JSON credential data.", e);

}

return FromJsonParameters<T>(credentialParameters);

try

{

return await NewtonsoftJsonSerializer.Instance.DeserializeAsync<JsonCredentialParameters>(stream, cancellationToken).ConfigureAwait(false);

}

catch (Exception e)

{

throw new InvalidOperationException("Error deserializing JSON credential data.", e);

}

I've merged all into one line as suggested.

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

amanda-tarafa · 2025-10-03T20:11:15Z

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs

+        }
+
+        CheckCompatibility(targetType, typeof(UserCredential));


Suggested change

}

CheckCompatibility(targetType, typeof(UserCredential));

}

CheckCompatibility(targetType, typeof(UserCredential));

But also, there's a lot of blank lines after. I think this may be your editor configuration, but it makes the code look longer than it actually is.

(This all can be done in a separate PR).

I made sure to remove the extra space introduced around check compatibility.

Introduces `CredentialFactory` to enable the safe creation of specific `IGoogleCredential` types (e.g., `UserCredential`, `ServiceAccountCredential`) from various sources.

…s as obsolete and add warnings to XML docs and incorporate CredentialFactory.

amanda-tarafa

Thanks!

Security related fix: - googleapis#3043 Depracate vulnerable credential loading mechanisms. See https://cloud.google.com/docs/authentication/client-libraries#external-credentials for more information.

Security related fix: - #3043 Depracate vulnerable credential loading mechanisms. See https://cloud.google.com/docs/authentication/client-libraries#external-credentials for more information.

robertvoinescu-work requested a review from a team September 15, 2025 22:18

robertvoinescu-work assigned amanda-tarafa Sep 16, 2025

amanda-tarafa requested changes Sep 16, 2025

View reviewed changes

amanda-tarafa mentioned this pull request Sep 17, 2025

fix(auth): Deprecate insecure credential loading methods #3035

Closed

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 2 times, most recently from 518d25a to 9351a40 Compare September 17, 2025 21:03

robertvoinescu-work requested a review from amanda-tarafa September 17, 2025 21:10

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 3 times, most recently from 42a6560 to 7160ca2 Compare September 17, 2025 21:47

robertvoinescu-work commented Sep 18, 2025

View reviewed changes

Src/Support/Google.Apis.Auth/OAuth2/CredentialFactory.cs Outdated Show resolved Hide resolved

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch from 7160ca2 to 0a05b66 Compare September 19, 2025 17:50

amanda-tarafa requested changes Sep 23, 2025

View reviewed changes

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 3 times, most recently from eeec372 to 5e2d08a Compare September 23, 2025 20:59

robertvoinescu-work requested a review from amanda-tarafa September 23, 2025 21:05

amanda-tarafa requested changes Sep 24, 2025

View reviewed changes

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch from 5e2d08a to 72332ca Compare September 25, 2025 18:06

robertvoinescu-work requested a review from amanda-tarafa September 25, 2025 18:10

amanda-tarafa requested changes Sep 29, 2025

View reviewed changes

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 7 times, most recently from 2cde44e to 98b17cf Compare September 30, 2025 22:56

robertvoinescu-work requested a review from amanda-tarafa September 30, 2025 23:11

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch from 98b17cf to 4c7e591 Compare September 30, 2025 23:14

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 4 times, most recently from aaa6477 to 26b6c29 Compare September 30, 2025 23:38

amanda-tarafa requested changes Oct 2, 2025

View reviewed changes

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch 2 times, most recently from c39bb24 to 2947315 Compare October 3, 2025 17:16

robertvoinescu-work requested a review from amanda-tarafa October 3, 2025 17:25

amanda-tarafa previously approved these changes Oct 3, 2025

View reviewed changes

robertvoinescu-work added 3 commits October 4, 2025 02:31

feat(Auth): Add CredentialFactory for strongly-typed credential creation

cd89aa7

Introduces `CredentialFactory` to enable the safe creation of specific `IGoogleCredential` types (e.g., `UserCredential`, `ServiceAccountCredential`) from various sources.

feat(Auth): add ToGoogleCredential method

ae88117

fix(Auth): Mark FromJson, FromFile, FromStream, and FromJsonParameter…

4a7d0b3

…s as obsolete and add warnings to XML docs and incorporate CredentialFactory.

robertvoinescu-work dismissed amanda-tarafa’s stale review via 4a7d0b3 October 4, 2025 02:36

robertvoinescu-work force-pushed the users/robertvoinescu/windy-eagle-mitigation branch from 2947315 to 4a7d0b3 Compare October 4, 2025 02:36

amanda-tarafa approved these changes Oct 6, 2025

View reviewed changes

robertvoinescu-work merged commit d6fed4a into googleapis:main Oct 6, 2025
4 checks passed

robertvoinescu-work deleted the users/robertvoinescu/windy-eagle-mitigation branch October 6, 2025 17:16

amanda-tarafa mentioned this pull request Oct 6, 2025

chore: Update version 1.71.0 -> 1.72.0 #3054

Merged

Conversation

robertvoinescu-work commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mitigating the "Windy Eagle" Credential Vulnerability

Key Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amanda-tarafa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amanda-tarafa left a comment

Choose a reason for hiding this comment

Uh oh!

amanda-tarafa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amanda-tarafa left a comment

Choose a reason for hiding this comment

Uh oh!

amanda-tarafa Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

robertvoinescu-work Oct 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

amanda-tarafa Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

robertvoinescu-work Oct 4, 2025

Choose a reason for hiding this comment

Uh oh!

amanda-tarafa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

robertvoinescu-work commented Sep 15, 2025 •

edited

Loading