lasdf1234 commented on code in PR #10800: URL: https://github.com/apache/gravitino/pull/10800#discussion_r3490200291
########## iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/CatalogWrapperForREST.java: ########## Review Comment: ScanPlanCacheKey does not include requestCredentialVending, and we cache the full PlanTableScanResponse (with or without credentials). This can cause: 1、Plan without header → plan with vended-credentials: cache hit returns a response without storage-credentials. 2、 Plan with header → plan without header: cache hit may return stale/extra credentials. 3、Cached credentials may expire while the scan plan remains valid. Suggestion: Cache only credential-free scan plans. Inject credentials after cache lookup on every request (hit or miss), similar to how loadTable generates credentials per request: -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
