Skip to content

fix(common): sign the session logon re-sent after a reconnect - #572

Merged
alplabin merged 1 commit into
binance:release_common_v4.6.0from
Amadeus-22:fix/569-sign-session-relogon
Oct 15, 2026
Merged

alplabin merged 1 commit into
binance:release_common_v4.6.0from
Amadeus-22:fix/569-sign-session-relogon

Conversation

@Amadeus-22

@Amadeus-22 Amadeus-22 commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #569.

Problem

After a WebSocket API connection is renewed, session_re_log_on re-sends session.logon built with api_key=False, skip_auth=True. With those options ws_api_payload only adds timestamp, so the logon goes out without apiKey and signature:

initial logon params: ['apiKey', 'signature', 'timestamp']
re-logon params:      ['timestamp']

The server answers -1102 Mandatory parameter 'apiKey' was not sent, but the client sets is_session_log_on = True anyway and stops signing the requests that follow.

Change

  • session_re_log_on now builds the payload with api_key=True, skip_auth=False, the same way the first logon is signed: apiKey, a fresh timestamp and a new signature.
  • The stored request's params are copied before signing, so the saved logon request is not modified and each reconnect signs from a clean copy.

Tests

Added TestSessionReLogOn in common/tests/unit/test_websocket.py:

  • the re-logon carries apiKey, timestamp and signature;
  • the stored request is unchanged after two re-logons;
  • nothing is sent when the session is already logged on.

The first test fails on master and passes with the change. pytest tests in common/ passes (375 tests). The new test code is formatted with black.

Not included

is_session_log_on is still set as soon as the message is sent, without waiting for the server's reply. Setting it from the response would be more correct, but it changes the reconnect flow, so I left it out of this fix. Happy to follow up if you want it.

🤖 Generated with Claude Code

session_re_log_on built the payload with api_key=False and skip_auth=True,
so the logon sent on a new connection carried only a timestamp. The server
rejects it (-1102, apiKey missing), while the client marks the session as
logged on and stops signing later requests.

The re-logon is now signed like the first one, with apiKey, a fresh
timestamp and a new signature. The stored request's params are copied, so
nothing from one re-logon leaks into the next.

Fixes binance#569

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@alplabin
alplabin changed the base branch from master to release_common_v4.6.0 October 15, 2026 11:37
@alplabin
alplabin merged commit 35459a5 into binance:release_common_v4.6.0 Oct 15, 2026
@Amadeus-22
Amadeus-22 deleted the fix/569-sign-session-relogon branch October 23, 2026 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] WebSocket API: session re-logon after reconnect is sent without apiKey and signature

2 participants