Bug: attempted login-request from Snowflake Client for every query

[YaroslavLitvinov]

:memo: New session is created by Embucket for every query

Currently regardless of Snowflake CLI version, as tested on snowsql v1.4.3 , snowflake-cli-3.10.1 client sends login-request for every new query.

Following is valid for single TCP stream:

1. Embucket sends authorization token in login-request response
2. Snowflake CLI sets correct Snowflake Token in query-request request 2.1. Snowflake CLI sets credentials in telemetry request as well

Every new query repeat login-request flow. In fact it runs it in a separate tcp connection. Also there are no cookie / set-cookie headers in all related requests / responses.

Easy to reproduce

snow sql -q "select 1" or snowsql -q "select '1'"

Expected behavior

• Embucket should create/reuse session and send session identifier to the Client,
• Snowflake CLI should send session identifier back to Embucket

[YaroslavLitvinov]

Embucket currently uses authorization schema based on Snowflake Token, which authorizes client on every new connection.

Probably in order to have different behaviour, Embucket should implement authorization schema based on Bearer token.

in context of snowflake rest

[DanCodedThis]

@YaroslavLitvinov Does snow sql cli allows for other auths?

[YaroslavLitvinov]

@YaroslavLitvinov Does snow sql cli allows for other auths?

i think yes, as snowflake python client has following handling:

    if token_type is TokenType.EXTERNAL_SESSION_WITH_PAT:
        return {
            "Authorization": f"Bearer {session_token}",
            "X-Snowflake-External-Session-ID": external_session_id or "",
            "X-Snowflake-Authorization-Token-Type": "PAT_WITH_EXTERNAL_SESSION_ID",
        }

[DanCodedThis]

@YaroslavLitvinov Does snow sql cli allows for other auths?

i think yes, as snowflake python client has following handling:

    if token_type is TokenType.EXTERNAL_SESSION_WITH_PAT:
        return {
            "Authorization": f"Bearer {session_token}",
            "X-Snowflake-External-Session-ID": external_session_id or "",
            "X-Snowflake-Authorization-Token-Type": "PAT_WITH_EXTERNAL_SESSION_ID",
        }

@YaroslavLitvinov That would be great to change, in some sense unifying, at least in concept, the auth in UI and Snowflake Rest.

[YaroslavLitvinov]

http-dump, typical for every new connection