snowflake-connector-python 4.7.4__tar.gz → 4.8.0__tar.gz

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/DESCRIPTION.md

@@ -7,6 +7,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
 - v4.7.4(Sep 16,2026)
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.4
+Version: 4.8.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -41,7 +41,7 @@ License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
 Requires-Dist: cryptography>=46.0.5
-Requires-Dist: pyOpenSSL>=24.0.0
+Requires-Dist: pyOpenSSL>=25.3.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
@@ -97,6 +97,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
 - v4.7.4(Sep 16,2026)
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/setup.cfg

@@ -46,7 +46,7 @@ packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
 	cryptography>=46.0.5
-	pyOpenSSL>=24.0.0
+	pyOpenSSL>=25.3.0
 	pyjwt>=2.10.1,<3.0.0
 	pytz
 	requests>=2.32.4,<3.0.0

snowflake_connector_python-4.8.0/src/snowflake/connector/_ocsp_mode.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, Collection
+
+from .constants import OCSPMode
+
+# ocsp_fail_open True/False opts into OCSP. None is the stored default and
+# is not an opt-in. disable_ocsp_checks / insecure_mode only turn OCSP off
+# when True; their stored False default is not an opt-in. Cache/timeout
+# knobs never enable OCSP.
+OCSP_MODE_PARAMS = frozenset({"disable_ocsp_checks", "ocsp_fail_open", "insecure_mode"})
+OCSP_SUPPORT_PARAMS = frozenset(
+    {"ocsp_response_cache_filename", "ocsp_root_certs_dict_lock_timeout"}
+)
+OCSP_EXPLICIT_PARAMS = OCSP_MODE_PARAMS | OCSP_SUPPORT_PARAMS
+
+IGNORED_OCSP_SUPPORT_PARAMS_WARNING = (
+    "OCSP is disabled unless you opt in. The following OCSP setting(s) will be "
+    "ignored because none of ocsp_fail_open, disable_ocsp_checks, or "
+    "insecure_mode was set: {params}. Set ocsp_fail_open=True or "
+    "ocsp_fail_open=False to enable OCSP."
+)
+
+
+def snapshot_ocsp_explicit_params(params: Mapping[str, Any]) -> frozenset[str]:
+    return frozenset(name for name in OCSP_EXPLICIT_PARAMS if name in params)
+
+
+def resolve_ocsp_mode(
+    *,
+    explicit: Collection[str],
+    disable_ocsp_checks: bool,
+    ocsp_fail_open: bool | None,
+    insecure_mode: bool | None = None,
+) -> OCSPMode:
+    """Resolve OCSP mode from explicit user/toml presence plus stored values.
+
+    ``ocsp_fail_open`` is the only opt-in: True = fail-open, False =
+    fail-closed. None is the stored default and does not enable OCSP, even
+    when the key is present (a caller forwarding DEFAULT_CONFIGURATION).
+
+    Connection-property disable (``disable_ocsp_checks=True`` or
+    ``insecure_mode=True``) always turns OCSP off, including when
+    ``ocsp_fail_open`` is True/False. Presence of
+    ``disable_ocsp_checks=False`` or ``insecure_mode=False`` is not an
+    opt-in; those are the stored defaults.
+    """
+    if "disable_ocsp_checks" in explicit:
+        disable_value = disable_ocsp_checks
+    elif "insecure_mode" in explicit:
+        disable_value = (
+            insecure_mode if insecure_mode is not None else disable_ocsp_checks
+        )
+    else:
+        disable_value = False
+
+    if disable_value:
+        return OCSPMode.DISABLE_OCSP_CHECKS
+    if ocsp_fail_open is not None:
+        return OCSPMode.FAIL_OPEN if ocsp_fail_open else OCSPMode.FAIL_CLOSED
+    return OCSPMode.DISABLE_OCSP_CHECKS
+
+
+def ignored_ocsp_support_params(explicit: Collection[str]) -> tuple[str, ...]:
+    if any(name in explicit for name in OCSP_MODE_PARAMS):
+        return ()
+    return tuple(sorted(name for name in OCSP_SUPPORT_PARAMS if name in explicit))

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/README.md

@@ -14,7 +14,7 @@ is not intended for production environments.**
 - ❌ `mfa_callback` / `password_callback` - not supported
 - ❌ `_probe_connection=True` - no connection diagnostic
 - ❌ Raw binary response handling - not supported
-- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported)
+- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported). OCSP is off by default; set `ocsp_fail_open=True`/`False` to enable it.
 
 ## Installation & Import
 

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_azure_storage_client.py

@@ -17,7 +17,6 @@ from ..azure_storage_client import (
 from ..compat import quote
 from ..constants import FileHeader, ResultStatus
 from ..encryption_util import EncryptionMetadata
-from ..util_text import get_md5_for_integrity
 from ._storage_client import SnowflakeStorageClient as SnowflakeStorageClientAsync
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -173,26 +172,12 @@ class SnowflakeAzureRestClient(
             part = ET.Element("Latest")
             part.text = block_id
             root.append(part)
-        # SNOW-1778088: We need to calculate the MD5 sum of this file for Azure Blob storage
-        new_stream = not bool(self.meta.src_stream or self.meta.intermediate_stream)
-        fd = (
-            self.meta.src_stream
-            or self.meta.intermediate_stream
-            or open(self.meta.real_src_file_name, "rb")
-        )
-        try:
-            if not new_stream:
-                # Reset position in file
-                fd.seek(0)
-            file_content = fd.read()
-        finally:
-            if new_stream:
-                fd.close()
+        # SNOW-1778088: We need to provide the MD5 sum of this file for Azure Blob storage.
         headers = {
             "x-ms-blob-content-encoding": "utf-8",
-            "x-ms-blob-content-md5": base64.b64encode(
-                get_md5_for_integrity(file_content)
-            ).decode("utf-8"),
+            "x-ms-blob-content-md5": base64.b64encode(self.meta.md5_digest).decode(
+                "utf-8"
+            ),
         }
         azure_metadata = self._prepare_file_metadata()
         headers.update(azure_metadata)

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_connection.py

@@ -23,6 +23,7 @@ from snowflake.connector import (
     OperationalError,
     ProgrammingError,
 )
+from snowflake.connector.errors import NonRetryableTlsError
 
 from .._connection_identifier_shape import (
     ConnectionIdentifierShape,
@@ -38,6 +39,7 @@ from ..connection import _get_private_bytes_from_file
 from ..constants import (
     _CONNECTIVITY_ERR_MSG,
     _OAUTH_DEFAULT_SCOPE,
+    ENV_VAR_MIN_TLS_VERSION,
     PARAMETER_AUTOCOMMIT,
     PARAMETER_CLIENT_PREFETCH_THREADS,
     PARAMETER_CLIENT_REQUEST_MFA_TOKEN,
@@ -570,6 +572,11 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 password_callback=self._password_callback,
                 session_parameters=self._session_parameters,
             )
+        except NonRetryableTlsError:
+            # See the sync counterpart: a TLS failure that a retry cannot fix must
+            # surface with its diagnosis rather than be replaced by the generic
+            # "could not connect" message the retry loop below ends with.
+            raise
         except OperationalError as e:
             logger.debug(
                 "Operational Error raised at authentication"
@@ -652,6 +659,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         self._rest = None
         for name, (value, _) in DEFAULT_CONFIGURATION.items():
             setattr(self, f"_{name}", value)
+        self._ocsp_explicit: frozenset[str] = frozenset()
 
         self._heartbeat_task = None
         is_kwargs_empty = not connection_init_kwargs
@@ -668,6 +676,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 DeprecationWarning,
                 stacklevel=2,
             )
+            self._insecure_mode = connection_init_kwargs["insecure_mode"]
 
             if (
                 "disable_ocsp_checks" in connection_init_kwargs
@@ -1110,6 +1119,20 @@ class SnowflakeConnection(SnowflakeConnectionSync):
     async def connect(self, **kwargs) -> None:
         """Establishes connection to Snowflake."""
         logger.debug("connect")
+        self._validate_min_tls_version()
+        # Validating the value here must not be read as enforcing it: the async
+        # stack builds its TLS contexts through aiohttp, which the connector's
+        # urllib3 interception never sees, so the floor is not applied to async
+        # handshakes. Say so rather than let a successful connect imply otherwise.
+        # Not raised, because the variable is process-wide -- failing here would
+        # break async connections in any process that set it for the sync path.
+        if os.environ.get(ENV_VAR_MIN_TLS_VERSION, "").strip():
+            logger.warning(
+                "%s is set but is not enforced on asynchronous connections; their "
+                "TLS handshakes may negotiate a lower version. Use a synchronous "
+                "connection where the minimum must be guaranteed.",
+                ENV_VAR_MIN_TLS_VERSION,
+            )
         if len(kwargs) > 0:
             self.__config(**kwargs)
         else:

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_network.py

@@ -42,6 +42,7 @@ from ..errors import (
     Error,
     ForbiddenError,
     HttpError,
+    NonRetryableTlsError,
     OperationalError,
     ProgrammingError,
     RefreshTokenError,
@@ -826,7 +827,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             Error.errorhandler_wrapper(
                 self._connection,
                 None,
-                OperationalError,
+                NonRetryableTlsError,
                 {
                     "msg": msg,
                     "errno": ER_FAILED_TO_REQUEST,

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_result_batch.py

@@ -32,7 +32,10 @@ from snowflake.connector.result_batch import DownloadMetrics
 from snowflake.connector.result_batch import JSONResultBatch as JSONResultBatchSync
 from snowflake.connector.result_batch import RemoteChunkInfo
 from snowflake.connector.result_batch import ResultBatch as ResultBatchSync
-from snowflake.connector.result_batch import _create_nanoarrow_iterator
+from snowflake.connector.result_batch import (
+    _create_nanoarrow_iterator,
+    inline_first_chunk_rowcount,
+)
 from snowflake.connector.secret_detector import SecretDetector
 
 if TYPE_CHECKING:
@@ -60,8 +63,7 @@ def create_batches_from_response(
     column_converters: list[tuple[str, SnowflakeConverterType]] = []
     arrow_context: ArrowConverterContext | None = None
     rowtypes = data["rowtype"]
-    total_len: int = data.get("total", 0)
-    first_chunk_len = total_len
+    first_chunk_len = inline_first_chunk_rowcount(data)
     rest_of_chunks: list[ResultBatch] = []
     if _format == "json":
 
@@ -138,8 +140,6 @@ def create_batches_from_response(
                 )
                 for c in chunks
             ]
-    for c in rest_of_chunks:
-        first_chunk_len -= c.rowcount
     if _format == "json":
         first_chunk = JSONResultBatch.from_data(
             data.get("rowset"),

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_session_manager.py

@@ -44,7 +44,7 @@ class SnowflakeSSLConnector(aiohttp.TCPConnector):
     def __init__(
         self,
         *args,
-        snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN,
+        snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS,
         session_manager: SessionManager | None = None,
         **kwargs,
     ):
@@ -139,7 +139,7 @@ class AioHttpConfig(BaseHttpConfig):
     """Trust environment variables for proxy configuration (HTTP_PROXY, HTTPS_PROXY, NO_PROXY).
     Required for proxy support set by proxy.set_proxies() in connection initialization."""
 
-    snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN
+    snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS
     """OCSP validation mode obtained from connection._ocsp_mode()."""
 
     def get_connector(

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_storage_client.py

@@ -104,6 +104,7 @@ class SnowflakeStorageClient(SnowflakeStorageClientSync):
         else:
             self.data_file = meta.real_src_file_name
         logger.debug("finished preprocessing")
+        self._compute_content_md5()
         if meta.upload_size < meta.multipart_threshold or not self.chunked_transfer:
             self.num_of_chunks = 1
         else:

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/auth/_webbrowser.py

@@ -25,7 +25,6 @@ from ...constants import (
     HTTP_HEADER_USER_AGENT,
 )
 from ...errorcode import (
-    ER_IDP_CONNECTION_ERROR,
     ER_INVALID_VALUE,
     ER_NO_HOSTNAME_FOUND,
     ER_UNABLE_TO_OPEN_BROWSER,
@@ -111,7 +110,7 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
                     )
                 else:
                     raise ex
-            socket_connection.listen(0)  # no backlog
+            socket_connection.listen(5)
             callback_port = socket_connection.getsockname()[1]
 
             if conn._disable_console_login:
@@ -246,34 +245,45 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
                             else:
                                 logger.debug("Exceeded retry count")
 
-                data = raw_data.decode("utf-8").split("\r\n")
+                if not raw_data:
+                    continue
 
-                if not await self._process_options(data, socket_client):
-                    await self._process_receive_saml_token(conn, data, socket_client)
+                data = raw_data.decode("utf-8").splitlines()
+
+                method = self._request_method(data)
+                if method == "OPTIONS":
+                    await self._process_options(data, socket_client)
+                    continue
+                if method not in {"GET", "POST"}:
+                    continue
+                if not self._validate_callback_origin(data):
+                    continue
+                if await self._process_receive_saml_token(conn, data, socket_client):
                     break
 
             finally:
-                socket_client.shutdown(socket.SHUT_RDWR)
-                socket_client.close()
+                self._close_socket_client(socket_client)
 
     async def _process_options(
         self, data: list[str], socket_client: socket.socket
     ) -> bool:
         """Allows JS Ajax access to this endpoint."""
-        for line in data:
-            if line.startswith("OPTIONS "):
-                break
-        else:
+        if self._request_method(data) != "OPTIONS":
             return False
 
         self._get_user_agent(data)
         requested_headers, requested_origin = self._check_post_requested(data)
-        if not requested_headers:
-            return False
+        if requested_origin is None:
+            return True
+
+        if requested_headers and any(
+            header.strip().lower() != "content-type"
+            for header in requested_headers.split(",")
+        ):
+            return True
 
         if not self._validate_origin(requested_origin):
-            # validate Origin and fail if not match with the server.
-            return False
+            return True
 
         self._origin = requested_origin
         content = [
@@ -281,8 +291,8 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
             "Date: {}".format(
                 time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime())
             ),
-            "Access-Control-Allow-Methods: POST, GET",
-            f"Access-Control-Allow-Headers: {requested_headers}",
+            "Access-Control-Allow-Methods: POST",
+            "Access-Control-Allow-Headers: Content-Type",
             "Access-Control-Max-Age: 86400",
             f"Access-Control-Allow-Origin: {self._origin}",
             "",
@@ -295,9 +305,9 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
 
     async def _process_receive_saml_token(
         self, conn: SnowflakeConnection, data: list[str], socket_client: socket.socket
-    ) -> None:
+    ) -> bool:
         if not self._process_get(data) and not await self._process_post(conn, data):
-            return  # error
+            return False
 
         content = [
             "HTTP/1.1 200 OK",
@@ -324,32 +334,23 @@ You can close this window now and go back where you started from.
         await self._event_loop.sock_sendall(
             socket_client, "\r\n".join(content).encode("utf-8")
         )
+        return True
 
     async def _process_post(self, conn: SnowflakeConnection, data: list[str]) -> bool:
-        for line in data:
-            if line.startswith("POST "):
-                break
-        else:
-            await self._handle_failure(
-                conn=conn,
-                ret={
-                    "code": ER_IDP_CONNECTION_ERROR,
-                    "message": "Invalid HTTP request from web browser. Idp "
-                    "authentication could have failed.",
-                },
-            )
+        body = self._request_body(data)
+        if self._request_method(data) != "POST" or body is None:
             return False
 
         self._get_user_agent(data)
         try:
             # parse the response as JSON
-            payload = json.loads(data[-1])
+            payload = json.loads(body)
             self._token = payload.get("token")
             self.consent_cache_id_token = payload.get("consent", True)
         except Exception:
             # key=value form.
-            self._token = parse_qs(data[-1])["token"][0]
-        return True
+            self._token = (parse_qs(body).get("token") or [None])[0]
+        return self._token is not None
 
     async def _get_sso_url(
         self,