From 6aaa4b3b4b4c85f8447615ea24c7d14be12dec85 Mon Sep 17 00:00:00 2001 From: Ejiro Asiuwhu Date: Thu, 26 Mar 2026 10:52:22 +0100 Subject: [PATCH] fix: guard against non-dict JSON in token refresh response resp.json() could return non-dict values (null, string, list) which would cause AttributeError on data.get("access_token"). Now checks isinstance(data, dict) first, returning (False, None) for malformed responses. Applied to both sync and async refresh helpers. --- sdks/implementations/python/src/stack_auth/_token_store.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sdks/implementations/python/src/stack_auth/_token_store.py b/sdks/implementations/python/src/stack_auth/_token_store.py index 5e6d415f5..1159de7ae 100644 --- a/sdks/implementations/python/src/stack_auth/_token_store.py +++ b/sdks/implementations/python/src/stack_auth/_token_store.py @@ -390,6 +390,8 @@ def _refresh_access_token_sync( ) if resp.status_code == 200: data = resp.json() + if not isinstance(data, dict): + return (False, None) return (True, data.get("access_token")) return (False, None) except (httpx.HTTPError, ValueError, KeyError) as exc: @@ -421,6 +423,8 @@ async def _refresh_access_token_async( ) if resp.status_code == 200: data = resp.json() + if not isinstance(data, dict): + return (False, None) return (True, data.get("access_token")) return (False, None) except (httpx.HTTPError, ValueError, KeyError) as exc: