diff --git a/src/core/lib/security/transport/client_auth_filter.cc b/src/core/lib/security/transport/client_auth_filter.cc
index dbe288237d4..1062fc2f4fa 100644
--- a/src/core/lib/security/transport/client_auth_filter.cc
+++ b/src/core/lib/security/transport/client_auth_filter.cc
@@ -121,11 +121,10 @@ void grpc_auth_metadata_context_copy(grpc_auth_metadata_context* from,
         ->Ref(DEBUG_LOCATION, "grpc_auth_metadata_context_copy")
         .release();
   }
-  to->service_url =
-      (from->service_url == nullptr) ? nullptr : strdup(from->service_url);
-  to->method_name =
-      (from->method_name == nullptr) ? nullptr : strdup(from->method_name);
+  to->service_url = gpr_strdup(from->service_url);
+  to->method_name = gpr_strdup(from->method_name);
 }
+
 void grpc_auth_metadata_context_reset(
     grpc_auth_metadata_context* auth_md_context) {
   if (auth_md_context->service_url != nullptr) {
diff --git a/src/cpp/client/secure_credentials.cc b/src/cpp/client/secure_credentials.cc
index 3d2a123180b..197112d4bb7 100644
--- a/src/cpp/client/secure_credentials.cc
+++ b/src/cpp/client/secure_credentials.cc
@@ -259,6 +259,8 @@ int MetadataCredentialsPluginWrapper::GetMetadata(
     return true;
   }
   if (w->plugin_->IsBlocking()) {
+    // The internals of context may be destroyed if GetMetadata is cancelled.
+    // Make a copy for InvokePlugin.
     grpc_auth_metadata_context context_copy = grpc_auth_metadata_context();
     grpc_auth_metadata_context_copy(&context, &context_copy);
     // Asynchronous return.