[JinmingHu (Jinming-Hu)]

Make concurrent Blob requests wait for in-flight session acquisition rather than immediately falling back to bearer authentication.

Design

• Serialize acquisition/refresh with one per-container std::timed_mutex. Callers needing acquisition/refresh wait, check their own cancellation/deadline every 100 ms, and recheck the cache after acquiring the lock. Fresh cached sessions bypass the acquisition mutex.
• Keep network calls outside the cache-state and global cache mutexes. The initiating caller holds only the acquisition mutex, released by RAII on success or exception. Different containers remain independent, and cancelling a waiter does not cancel creation or other callers.
• Give each Create Session attempt a 60-second child-context deadline, with the caller's earlier deadline/cancellation preserved. This bounds cooperative credential and transport operations; it cannot force-stop custom implementations that ignore cancellation. Waiters without a deadline can still remain blocked behind such an implementation.
• Preserve existing bearer fallback, failure cooldown, retry suppression, and hard-error propagation. A rejected session is still invalidated and the request retried with bearer as before. Auto and Disabled remain unchanged.
• No session-required classifier, required/optional branches, cached acquisition exceptions, futures/promises, or session-only recovery retry. If an operation does not support bearer authentication, its normal service error is surfaced; the SDK does not enforce a separate session-required contract.

This draft is based on public main and adds no public API. Authentication/pipeline behavior requires maintainer review before merging.

Validation

Tests were neither added nor run, as requested. A full package build was not run.

• Formatted the three changed C++ files with clang-format 11.0.0.
• git -C C:\wd\azure-sdk-for-cpp-session-required diff --check — passed.
• C++14 syntax check — passed for both changed translation units, using the existing dependency headers. The Visual Studio environment setup emitted a vswhere.exe warning, but cl completed successfully without source diagnostics:

& $env:ComSpec /c 'call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat" >nul && cd /d C:\wd\azure-sdk-for-cpp-session-required && cl /nologo /std:c++14 /EHsc /Zs /W4 /I sdk\core\azure-core\inc /I sdk\storage\azure-storage-common\inc /I sdk\storage\azure-storage-blobs\inc /I C:\wd\azure-sdk-for-cpp\build\vcpkg_installed\x64-windows\include sdk\storage\azure-storage-blobs\src\private\session_authentication_policy.cpp sdk\storage\azure-storage-blobs\src\private\token_credential_session_provider.cpp'

Pull Request Checklist

Please leverage this checklist as a reminder to address commonly occurring feedback when submitting a pull request to make sure your PR can be reviewed quickly:

See the detailed list in the contributing guide.

• C++ Guidelines
• Doxygen docs
• Unit tests
• No unwanted commits/changes
• Descriptive title/description
  • PR is single purpose
  • Related issue listed
• Comments in source
• No typos
• Update changelog
• Not work-in-progress
• External references or docs updated
• Self review of PR done
• Any breaking changes?

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.