Reads path on every fetch, trimmed; a missing, unreadable, blank or oversized file, or a path that is not a regular file, is an AuthenticationError. Symbolic links are followed, as Kubernetes projected volumes and spiffe-helper rotate a token by swapping a link; the target is checked to be a regular file before it is opened, so a FIFO or a device is never opened (and cannot block a fetch), and the read itself stops after MaxTokenFileBytes + 1 bytes, so even a file swapped between the check and the open cannot be read unbounded. Neither the file's content nor any part of it is put in an error.
Reads path on every fetch, trimmed; a missing, unreadable, blank or oversized file, or a path that is not a regular file, is an AuthenticationError. Symbolic links are followed, as Kubernetes projected volumes and spiffe-helper rotate a token by swapping a link; the target is checked to be a regular file before it is opened, so a FIFO or a device is never opened (and cannot block a fetch), and the read itself stops after MaxTokenFileBytes + 1 bytes, so even a file swapped between the check and the open cannot be read unbounded. Neither the file's content nor any part of it is put in an error.