Fix mutable reference headers #1095

supabase/_async/client.py

@@ -1,4 +1,5 @@
 import asyncio
+import copy
 import re
 from typing import Any, Dict, List, Optional, Union
 
@@ -69,7 +70,7 @@ def __init__(
 
         self.supabase_url = supabase_url
         self.supabase_key = supabase_key
-        self.options = options
+        self.options = copy.deepcopy(options)
         options.headers.update(self._get_auth_headers())
         self.rest_url = f"{supabase_url}/rest/v1"
         self.realtime_url = f"{supabase_url}/realtime/v1".replace("http", "ws")
@@ -294,8 +295,9 @@ def _listen_to_auth_events(
             self._storage = None
             self._functions = None
             access_token = session.access_token if session else self.supabase_key
-
-        self.options.headers["Authorization"] = self._create_auth_header(access_token)
+        auth_header = copy.deepcopy(self._create_auth_header(access_token))
+        self.options.headers["Authorization"] = auth_header
+        self.auth._headers["Authorization"] = auth_header
         asyncio.create_task(self.realtime.set_auth(access_token))
 
 

supabase/_sync/client.py

@@ -1,3 +1,4 @@
+import copy
 import re
 from typing import Any, Dict, List, Optional, Union
 
@@ -62,13 +63,11 @@ def __init__(
             r"^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$", supabase_key
         ):
             raise SupabaseException("Invalid API key")
-
         if options is None:
             options = ClientOptions(storage=SyncMemoryStorage())
-
         self.supabase_url = supabase_url
         self.supabase_key = supabase_key
-        self.options = options
+        self.options = copy.deepcopy(options)
         options.headers.update(self._get_auth_headers())
         self.rest_url = f"{supabase_url}/rest/v1"
         self.realtime_url = f"{supabase_url}/realtime/v1".replace("http", "ws")
@@ -100,17 +99,15 @@ def create(
     ):
         auth_header = options.headers.get("Authorization") if options else None
         client = cls(supabase_url, supabase_key, options)
-
+        session_access_token = None
         if auth_header is None:
             try:
                 session = client.auth.get_session()
                 session_access_token = client._create_auth_header(session.access_token)
             except Exception as err:
                 session_access_token = None
 
-            client.options.headers.update(
-                client._get_auth_headers(session_access_token)
-            )
+        client.options.headers.update(client._get_auth_headers(session_access_token))
 
         return client
 
@@ -293,8 +290,9 @@ def _listen_to_auth_events(
             self._storage = None
             self._functions = None
             access_token = session.access_token if session else self.supabase_key
-
-        self.options.headers["Authorization"] = self._create_auth_header(access_token)
+        auth_header = copy.deepcopy(self._create_auth_header(access_token))
+        self.options.headers["Authorization"] = auth_header
+        self.auth._headers["Authorization"] = auth_header
 
 
 def create_client(

tests/test_client.py

@@ -5,6 +5,7 @@
 from unittest.mock import MagicMock
 
 import pytest
+from gotrue import SyncMemoryStorage
 
 from supabase import Client, ClientOptions, SupabaseException, create_client
 
@@ -101,7 +102,6 @@ def test_updates_the_authorization_header_on_auth_events() -> None:
     mock_session = MagicMock(access_token="secretuserjwt")
     realtime_mock = MagicMock()
     client.realtime = realtime_mock
-
     client._listen_to_auth_events("SIGNED_IN", mock_session)
 
     updated_authorization = f"Bearer {mock_session.access_token}"
@@ -113,9 +113,38 @@ def test_updates_the_authorization_header_on_auth_events() -> None:
     assert (
         client.postgrest.session.headers.get("Authorization") == updated_authorization
     )
-
     assert client.auth._headers.get("apiKey") == key
     assert client.auth._headers.get("Authorization") == updated_authorization
 
     assert client.storage.session.headers.get("apiKey") == key
     assert client.storage.session.headers.get("Authorization") == updated_authorization
+
+
+def test_mutable_headers_issue():
+    url = os.environ.get("SUPABASE_TEST_URL")
+    key = os.environ.get("SUPABASE_TEST_KEY")
+
+    shared_options = ClientOptions(
+        storage=SyncMemoryStorage(), headers={"Authorization": "Bearer initial-token"}
+    )
+
+    client1 = create_client(url, key, shared_options)
+
+    client2 = create_client(url, key, shared_options)
+
+    client1.options.headers["Authorization"] = "Bearer modified-token"
+
+    assert client2.options.headers["Authorization"] == "Bearer initial-token"
+
+
+
+def test_global_authorization_header_issue():
+    url = os.environ.get("SUPABASE_TEST_URL")
+    key = os.environ.get("SUPABASE_TEST_KEY")
+
+    authorization = "Bearer secretuserjwt"
+    options = ClientOptions(headers={"Authorization": authorization})
+
+    client = create_client(url, key, options)
+
+    assert client.options.headers.get("apiKey") == key