Re: [PR] Ensure that the the generated airflow.cfg contains a random jwt_secret and fernet_key [airflow]

["jscheffl (via GitHub)" <gi...@apache.org>]

jscheffl commented on PR #46966:
URL: https://github.com/apache/airflow/pull/46966#issuecomment-2722793134

   Okay, just saw this PR... because came-down attempting to debug why EdgeWorker in breeze fails since a few days.
   In breeze if the secrets are not set (they are not per default) then every process call generates a new token. If you start breeze and run `airflow config list|grep secret_key` you see that there is with every call a new secret being generated.
   
   While I assume this is a good hardening, I think in breeze we need to fix this. Will raise a PR in a moment.
   
   Otherwise, did we consider back-porting to 2.10 branch? If it is security relevant we should bring it there as well?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org