[Core] Add authentication token logic and related tests #58046

sampan-s-nayak · 2025-10-23T16:19:05Z

Description

this pr sets up the helper classes and utils to enable token based authentication for ray core rpc calls.

Related issues

NA

Additional information

Signed-off-by: sampan <sampan@anyscale.com>

cursor · 2025-10-23T16:20:10Z

Bug: Whitespace Handling Causes Undefined Behavior

The TrimWhitespace function relies on undefined behavior when an input string contains only whitespace. If find_last_not_of returns std::string::npos, adding 1 to it causes integer wraparound, leading to erase(0). While this happens to produce the correct empty string, the underlying logic is fragile.

cursor · 2025-10-23T16:20:11Z

Bug: Environment Variables Reference Invalid Memory

On Windows, _putenv is called with temporary strings, such as in set_env_var and the USERPROFILE setup. This results in environment variables pointing to invalid memory after the temporary string is destroyed.

Additional Locations (1)

src/ray/rpc/tests/authentication_token_loader_test.cc#L112-L113

gemini-code-assist

Code Review

This pull request introduces token-based authentication for Ray Core RPCs, which is a great security enhancement. The changes include a secure AuthenticationToken class, a loader for tokens from various sources, and related configuration. The implementation is well-structured and includes comprehensive tests.

I've found a critical issue in the test suite on Windows related to environment variable handling that needs to be addressed. I've also left a few other comments for improving code style, efficiency, and robustness. Overall, this is a solid contribution.

src/ray/rpc/tests/authentication_token_loader_test.cc

src/ray/rpc/authentication/authentication_token.h

src/ray/rpc/authentication/authentication_token_loader.cc

src/ray/rpc/tests/authentication_token_loader_test.cc

Signed-off-by: sampan <sampan@anyscale.com>

cursor · 2025-10-23T16:28:00Z

Bug: Whitespace Handling Bug in `TrimWhitespace` Function

The TrimWhitespace function incorrectly handles strings containing only whitespace. When find_last_not_of returns std::string::npos after leading whitespace is removed, adding 1 causes integer wraparound. This leads to an erase call that fails to clear the string, leaving it with whitespace instead of empty.

Signed-off-by: sampan <sampan@anyscale.com>

edoakes · 2025-10-24T21:45:53Z

src/ray/rpc/authentication/authentication_token.h

+    // Clear the moved-from object explicitly for security
+    // Note: 'other' is already an rvalue reference, no need to move again
+    other.SecureClear();
+  }


my only concern here is that this is a bit of an expensive move operation... we should keep it in mind once we run release/performance tests if there is any significant regression.

…58046) This pr sets up the helper classes and utils to enable token based authentication for ray core rpc calls. --------- Signed-off-by: sampan <sampan@anyscale.com> Co-authored-by: sampan <sampan@anyscale.com> Signed-off-by: xgui <xgui@anyscale.com>

…er interfaces (#58047) ## Description builds on top of #58046 and adds support for token based authentication in all grpc services and clients which are built on top of the grpc client server framework ## Related issues ## Additional information --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com>

…58046) This pr sets up the helper classes and utils to enable token based authentication for ray core rpc calls. --------- Signed-off-by: sampan <sampan@anyscale.com> Co-authored-by: sampan <sampan@anyscale.com>

…er interfaces (ray-project#58047) ## Description builds on top of ray-project#58046 and adds support for token based authentication in all grpc services and clients which are built on top of the grpc client server framework ## Related issues ## Additional information --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com>

…58046) This pr sets up the helper classes and utils to enable token based authentication for ray core rpc calls. --------- Signed-off-by: sampan <sampan@anyscale.com> Co-authored-by: sampan <sampan@anyscale.com> Signed-off-by: Aydin Abiar <aydin@anyscale.com>

…er interfaces (ray-project#58047) ## Description builds on top of ray-project#58046 and adds support for token based authentication in all grpc services and clients which are built on top of the grpc client server framework ## Related issues ## Additional information --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com> Signed-off-by: Aydin Abiar <aydin@anyscale.com>

…58046) This pr sets up the helper classes and utils to enable token based authentication for ray core rpc calls. --------- Signed-off-by: sampan <sampan@anyscale.com> Co-authored-by: sampan <sampan@anyscale.com> Signed-off-by: Future-Outlier <eric901201@gmail.com>

…er interfaces (ray-project#58047) ## Description builds on top of ray-project#58046 and adds support for token based authentication in all grpc services and clients which are built on top of the grpc client server framework ## Related issues ## Additional information --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com> Signed-off-by: Future-Outlier <eric901201@gmail.com>

Add authentication token logic and related tests

ce73705

Signed-off-by: sampan <sampan@anyscale.com>

sampan-s-nayak requested a review from a team as a code owner October 23, 2025 16:19

gemini-code-assist bot reviewed Oct 23, 2025

View reviewed changes

This was referenced Oct 23, 2025

[Core] support token based authentication in c++ grpc client and server interfaces #58047

Merged

[Core] Authentication for ray core rpc calls - part 1 #57789

Closed

sampan added 2 commits October 23, 2025 16:25

revert unneeded changs from src/ray/rpc/tests/BUILD.bazel

c821c21

Signed-off-by: sampan <sampan@anyscale.com>

readd dependencies

a14dc69

Signed-off-by: sampan <sampan@anyscale.com>

sampan-s-nayak requested a review from edoakes October 23, 2025 16:27

sampan-s-nayak added the go add ONLY when ready to merge, run all tests label Oct 23, 2025

ray-gardener bot added the core Issues that should be addressed in Ray Core label Oct 23, 2025

Merge branch 'master' into token_auth_1

7834733

This comment was marked as outdated.

Sign in to view

address comments + fix build

4801ed7

Signed-off-by: sampan <sampan@anyscale.com>

edoakes approved these changes Oct 24, 2025

View reviewed changes

edoakes merged commit b197fa8 into master Oct 24, 2025
6 checks passed

edoakes deleted the token_auth_1 branch October 24, 2025 21:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Core] Add authentication token logic and related tests #58046

[Core] Add authentication token logic and related tests #58046

Uh oh!

sampan-s-nayak commented Oct 23, 2025 •

edited

Loading

Uh oh!

cursor bot commented Oct 23, 2025

Uh oh!

cursor bot commented Oct 23, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot commented Oct 23, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

edoakes Oct 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[Core] Add authentication token logic and related tests #58046

[Core] Add authentication token logic and related tests #58046

Uh oh!

Conversation

sampan-s-nayak commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related issues

Additional information

Uh oh!

cursor bot commented Oct 23, 2025

Bug: Whitespace Handling Causes Undefined Behavior

Uh oh!

cursor bot commented Oct 23, 2025

Bug: Environment Variables Reference Invalid Memory

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot commented Oct 23, 2025

Bug: Whitespace Handling Bug in TrimWhitespace Function

Uh oh!

This comment was marked as outdated.

Uh oh!

edoakes Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sampan-s-nayak commented Oct 23, 2025 •

edited

Loading

Bug: Whitespace Handling Bug in `TrimWhitespace` Function