Raise HTTP error if encountered by joshtemple · Pull Request #1167

Raise HTTP error if encountered by joshtemple · Pull Request #1167 · googleapis/google-auth-library-python

chalmerlowe pushed a commit that referenced this pull request

Dec 19, 2025

Instead of crashing with a KeyError when the ID token is missing from the
response (even if the status code is 200), raise a proper RefreshError.

Fixes #1167

chalmerlowe pushed a commit that referenced this pull request

Dec 19, 2025

Instead of crashing with a KeyError when the ID token is missing from the
response (even if the status code is 200), raise a proper RefreshError.

Fixes #1167

chalmerlowe pushed a commit that referenced this pull request

Dec 20, 2025

…#1897)

Previously, `IDTokenCredentials.refresh` would raise a `KeyError` if the
response from the IAM server was `200 OK` but did not contain the
expected "token" field. This change wraps the token extraction in a
`try...except` block to catch `KeyError` (and `ValueError` for malformed
JSON) and raises a `google.auth.exceptions.RefreshError` instead, which
is the expected behavior for credential refresh failures.

I've added a new test `tests/test_impersonated_credentials.py` to
verify:
1.  A `200 OK` response with a missing token now raises `RefreshError`.
2.  Non-200 responses (e.g., 403) still raise `RefreshError` as before.

---
This PR replaces the PR #1167 from 3 years ago that addressed this
issue, but was less robust/not fully correct.

*PR created automatically by Jules for task
[3520893520890582850](https://jules.google.com/task/3520893520890582850)
started by @chalmerlowe*

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>