snowflake-connector-python 4.7.5__tar.gz → 4.8.0__tar.gz

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/DESCRIPTION.md

@@ -7,6 +7,14 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
 - v4.7.5(Sep 18,2026)
   - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
 
@@ -14,8 +22,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
-  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
-  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.5
+Version: 4.8.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -41,7 +41,7 @@ License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
 Requires-Dist: cryptography>=46.0.5
-Requires-Dist: pyOpenSSL>=24.0.0
+Requires-Dist: pyOpenSSL>=25.3.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
@@ -97,6 +97,14 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
 - v4.7.5(Sep 18,2026)
   - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
 
@@ -104,8 +112,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
-  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
-  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/setup.cfg

@@ -46,7 +46,7 @@ packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
 	cryptography>=46.0.5
-	pyOpenSSL>=24.0.0
+	pyOpenSSL>=25.3.0
 	pyjwt>=2.10.1,<3.0.0
 	pytz
 	requests>=2.32.4,<3.0.0

snowflake_connector_python-4.8.0/src/snowflake/connector/_ocsp_mode.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, Collection
+
+from .constants import OCSPMode
+
+# ocsp_fail_open True/False opts into OCSP. None is the stored default and
+# is not an opt-in. disable_ocsp_checks / insecure_mode only turn OCSP off
+# when True; their stored False default is not an opt-in. Cache/timeout
+# knobs never enable OCSP.
+OCSP_MODE_PARAMS = frozenset({"disable_ocsp_checks", "ocsp_fail_open", "insecure_mode"})
+OCSP_SUPPORT_PARAMS = frozenset(
+    {"ocsp_response_cache_filename", "ocsp_root_certs_dict_lock_timeout"}
+)
+OCSP_EXPLICIT_PARAMS = OCSP_MODE_PARAMS | OCSP_SUPPORT_PARAMS
+
+IGNORED_OCSP_SUPPORT_PARAMS_WARNING = (
+    "OCSP is disabled unless you opt in. The following OCSP setting(s) will be "
+    "ignored because none of ocsp_fail_open, disable_ocsp_checks, or "
+    "insecure_mode was set: {params}. Set ocsp_fail_open=True or "
+    "ocsp_fail_open=False to enable OCSP."
+)
+
+
+def snapshot_ocsp_explicit_params(params: Mapping[str, Any]) -> frozenset[str]:
+    return frozenset(name for name in OCSP_EXPLICIT_PARAMS if name in params)
+
+
+def resolve_ocsp_mode(
+    *,
+    explicit: Collection[str],
+    disable_ocsp_checks: bool,
+    ocsp_fail_open: bool | None,
+    insecure_mode: bool | None = None,
+) -> OCSPMode:
+    """Resolve OCSP mode from explicit user/toml presence plus stored values.
+
+    ``ocsp_fail_open`` is the only opt-in: True = fail-open, False =
+    fail-closed. None is the stored default and does not enable OCSP, even
+    when the key is present (a caller forwarding DEFAULT_CONFIGURATION).
+
+    Connection-property disable (``disable_ocsp_checks=True`` or
+    ``insecure_mode=True``) always turns OCSP off, including when
+    ``ocsp_fail_open`` is True/False. Presence of
+    ``disable_ocsp_checks=False`` or ``insecure_mode=False`` is not an
+    opt-in; those are the stored defaults.
+    """
+    if "disable_ocsp_checks" in explicit:
+        disable_value = disable_ocsp_checks
+    elif "insecure_mode" in explicit:
+        disable_value = (
+            insecure_mode if insecure_mode is not None else disable_ocsp_checks
+        )
+    else:
+        disable_value = False
+
+    if disable_value:
+        return OCSPMode.DISABLE_OCSP_CHECKS
+    if ocsp_fail_open is not None:
+        return OCSPMode.FAIL_OPEN if ocsp_fail_open else OCSPMode.FAIL_CLOSED
+    return OCSPMode.DISABLE_OCSP_CHECKS
+
+
+def ignored_ocsp_support_params(explicit: Collection[str]) -> tuple[str, ...]:
+    if any(name in explicit for name in OCSP_MODE_PARAMS):
+        return ()
+    return tuple(sorted(name for name in OCSP_SUPPORT_PARAMS if name in explicit))

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/README.md

@@ -14,7 +14,7 @@ is not intended for production environments.**
 - ❌ `mfa_callback` / `password_callback` - not supported
 - ❌ `_probe_connection=True` - no connection diagnostic
 - ❌ Raw binary response handling - not supported
-- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported)
+- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported). OCSP is off by default; set `ocsp_fail_open=True`/`False` to enable it.
 
 ## Installation & Import
 

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_azure_storage_client.py

@@ -17,7 +17,6 @@ from ..azure_storage_client import (
 from ..compat import quote
 from ..constants import FileHeader, ResultStatus
 from ..encryption_util import EncryptionMetadata
-from ..util_text import get_md5_for_integrity
 from ._storage_client import SnowflakeStorageClient as SnowflakeStorageClientAsync
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -173,26 +172,12 @@ class SnowflakeAzureRestClient(
             part = ET.Element("Latest")
             part.text = block_id
             root.append(part)
-        # SNOW-1778088: We need to calculate the MD5 sum of this file for Azure Blob storage
-        new_stream = not bool(self.meta.src_stream or self.meta.intermediate_stream)
-        fd = (
-            self.meta.src_stream
-            or self.meta.intermediate_stream
-            or open(self.meta.real_src_file_name, "rb")
-        )
-        try:
-            if not new_stream:
-                # Reset position in file
-                fd.seek(0)
-            file_content = fd.read()
-        finally:
-            if new_stream:
-                fd.close()
+        # SNOW-1778088: We need to provide the MD5 sum of this file for Azure Blob storage.
         headers = {
             "x-ms-blob-content-encoding": "utf-8",
-            "x-ms-blob-content-md5": base64.b64encode(
-                get_md5_for_integrity(file_content)
-            ).decode("utf-8"),
+            "x-ms-blob-content-md5": base64.b64encode(self.meta.md5_digest).decode(
+                "utf-8"
+            ),
         }
         azure_metadata = self._prepare_file_metadata()
         headers.update(azure_metadata)

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_connection.py

@@ -659,6 +659,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         self._rest = None
         for name, (value, _) in DEFAULT_CONFIGURATION.items():
             setattr(self, f"_{name}", value)
+        self._ocsp_explicit: frozenset[str] = frozenset()
 
         self._heartbeat_task = None
         is_kwargs_empty = not connection_init_kwargs
@@ -675,6 +676,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 DeprecationWarning,
                 stacklevel=2,
             )
+            self._insecure_mode = connection_init_kwargs["insecure_mode"]
 
             if (
                 "disable_ocsp_checks" in connection_init_kwargs

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_session_manager.py

@@ -44,7 +44,7 @@ class SnowflakeSSLConnector(aiohttp.TCPConnector):
     def __init__(
         self,
         *args,
-        snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN,
+        snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS,
         session_manager: SessionManager | None = None,
         **kwargs,
     ):
@@ -139,7 +139,7 @@ class AioHttpConfig(BaseHttpConfig):
     """Trust environment variables for proxy configuration (HTTP_PROXY, HTTPS_PROXY, NO_PROXY).
     Required for proxy support set by proxy.set_proxies() in connection initialization."""
 
-    snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN
+    snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS
     """OCSP validation mode obtained from connection._ocsp_mode()."""
 
     def get_connector(

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/_storage_client.py

@@ -104,6 +104,7 @@ class SnowflakeStorageClient(SnowflakeStorageClientSync):
         else:
             self.data_file = meta.real_src_file_name
         logger.debug("finished preprocessing")
+        self._compute_content_md5()
         if meta.upload_size < meta.multipart_threshold or not self.chunked_transfer:
             self.num_of_chunks = 1
         else:

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.0}/src/snowflake/connector/aio/auth/_webbrowser.py

@@ -25,7 +25,6 @@ from ...constants import (
     HTTP_HEADER_USER_AGENT,
 )
 from ...errorcode import (
-    ER_IDP_CONNECTION_ERROR,
     ER_INVALID_VALUE,
     ER_NO_HOSTNAME_FOUND,
     ER_UNABLE_TO_OPEN_BROWSER,
@@ -111,7 +110,7 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
                     )
                 else:
                     raise ex
-            socket_connection.listen(0)  # no backlog
+            socket_connection.listen(5)
             callback_port = socket_connection.getsockname()[1]
 
             if conn._disable_console_login:
@@ -246,34 +245,45 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
                             else:
                                 logger.debug("Exceeded retry count")
 
-                data = raw_data.decode("utf-8").split("\r\n")
+                if not raw_data:
+                    continue
 
-                if not await self._process_options(data, socket_client):
-                    await self._process_receive_saml_token(conn, data, socket_client)
+                data = raw_data.decode("utf-8").splitlines()
+
+                method = self._request_method(data)
+                if method == "OPTIONS":
+                    await self._process_options(data, socket_client)
+                    continue
+                if method not in {"GET", "POST"}:
+                    continue
+                if not self._validate_callback_origin(data):
+                    continue
+                if await self._process_receive_saml_token(conn, data, socket_client):
                     break
 
             finally:
-                socket_client.shutdown(socket.SHUT_RDWR)
-                socket_client.close()
+                self._close_socket_client(socket_client)
 
     async def _process_options(
         self, data: list[str], socket_client: socket.socket
     ) -> bool:
         """Allows JS Ajax access to this endpoint."""
-        for line in data:
-            if line.startswith("OPTIONS "):
-                break
-        else:
+        if self._request_method(data) != "OPTIONS":
             return False
 
         self._get_user_agent(data)
         requested_headers, requested_origin = self._check_post_requested(data)
-        if not requested_headers:
-            return False
+        if requested_origin is None:
+            return True
+
+        if requested_headers and any(
+            header.strip().lower() != "content-type"
+            for header in requested_headers.split(",")
+        ):
+            return True
 
         if not self._validate_origin(requested_origin):
-            # validate Origin and fail if not match with the server.
-            return False
+            return True
 
         self._origin = requested_origin
         content = [
@@ -281,8 +291,8 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
             "Date: {}".format(
                 time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime())
             ),
-            "Access-Control-Allow-Methods: POST, GET",
-            f"Access-Control-Allow-Headers: {requested_headers}",
+            "Access-Control-Allow-Methods: POST",
+            "Access-Control-Allow-Headers: Content-Type",
             "Access-Control-Max-Age: 86400",
             f"Access-Control-Allow-Origin: {self._origin}",
             "",
@@ -295,9 +305,9 @@ class AuthByWebBrowser(AuthByPluginAsync, AuthByWebBrowserSync):
 
     async def _process_receive_saml_token(
         self, conn: SnowflakeConnection, data: list[str], socket_client: socket.socket
-    ) -> None:
+    ) -> bool:
         if not self._process_get(data) and not await self._process_post(conn, data):
-            return  # error
+            return False
 
         content = [
             "HTTP/1.1 200 OK",
@@ -324,32 +334,23 @@ You can close this window now and go back where you started from.
         await self._event_loop.sock_sendall(
             socket_client, "\r\n".join(content).encode("utf-8")
         )
+        return True
 
     async def _process_post(self, conn: SnowflakeConnection, data: list[str]) -> bool:
-        for line in data:
-            if line.startswith("POST "):
-                break
-        else:
-            await self._handle_failure(
-                conn=conn,
-                ret={
-                    "code": ER_IDP_CONNECTION_ERROR,
-                    "message": "Invalid HTTP request from web browser. Idp "
-                    "authentication could have failed.",
-                },
-            )
+        body = self._request_body(data)
+        if self._request_method(data) != "POST" or body is None:
             return False
 
         self._get_user_agent(data)
         try:
             # parse the response as JSON
-            payload = json.loads(data[-1])
+            payload = json.loads(body)
             self._token = payload.get("token")
             self.consent_cache_id_token = payload.get("consent", True)
         except Exception:
             # key=value form.
-            self._token = parse_qs(data[-1])["token"][0]
-        return True
+            self._token = (parse_qs(body).get("token") or [None])[0]
+        return self._token is not None
 
     async def _get_sso_url(
         self,