You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "srchilukoori (via GitHub)" <gi...@apache.org> on 2026/04/23 17:08:24 UTC
[PR] Fix FAB password hashing to respect FAB_PASSWORD_HASH_METHOD config [airflow]
srchilukoori opened a new pull request, #65735:
URL: https://github.com/apache/airflow/pull/65735
## Summary
Fixes #65728.
Three `generate_password_hash(password)` calls in `FabAirflowSecurityManagerOverride` used werkzeug's default hashing method, ignoring `FAB_PASSWORD_HASH_METHOD` in the Flask app config. On FIPS-compliant systems (which ban MD5/SHA-1), werkzeug's default may produce incompatible hashes depending on the installed version, and operators cannot override it.
Changes:
- Adds `_hash_password(password)` helper that reads `FAB_PASSWORD_HASH_METHOD` from `current_app.config` (defaulting to `scrypt`) and passes it to `generate_password_hash`
- Replaces 3 bare `generate_password_hash(password)` calls in `reset_password`, `add_user`, and `add_register_user` with `self._hash_password(password)`
- Adds 4 tests covering the helper's config-forwarding behaviour and both callers
## Test plan
- [x] `test_hash_password_uses_fab_password_hash_method` — helper forwards configured method
- [x] `test_hash_password_defaults_to_scrypt_when_config_absent` — falls back to `scrypt`
- [x] `test_reset_password_uses_configured_hash_method` — `reset_password` uses configured method
- [x] `test_add_user_uses_configured_hash_method` — `add_user` uses configured method
- [x] Full FAB provider test suite: **508 passed, 2 skipped** (no regressions)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix FAB password hashing to respect FAB_PASSWORD_HASH_METHOD config [airflow]
Posted by "srchilukoori (via GitHub)" <gi...@apache.org>.
srchilukoori commented on PR #65735:
URL: https://github.com/apache/airflow/pull/65735#issuecomment-4319597043
@vincbeck please merge the PR. Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix FAB password hashing to respect FAB_PASSWORD_HASH_METHOD config [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #65735:
URL: https://github.com/apache/airflow/pull/65735
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix FAB password hashing to respect FAB_PASSWORD_HASH_METHOD config [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #65735:
URL: https://github.com/apache/airflow/pull/65735#issuecomment-4307518261
CI is failing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org