You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "KushagraB424 (via GitHub)" <gi...@apache.org> on 2026/07/18 21:05:19 UTC
[PR] Refactor xcom jwt url [airflow]
KushagraB424 opened a new pull request, #70081:
URL: https://github.com/apache/airflow/pull/70081
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
### Description
The Task Execution API's `set_xcom` endpoint implicitly has access to the current task instance identifiers through the injected JWT token. Removing the task identifiers (`dag_id`, `run_id`, `task_id`) from the URL simplifies routing, prevents clients from providing conflicting or invalid identifiers, and enforces zero-trust security where a task instance can only write its own XComs.
This refactor:
- Updates the `has_xcom_access` dependency to handle write requests gracefully without requiring `dag_id` in the URL path.
- Modifies the `set_xcom` endpoint to query identifiers securely from the database via the token.
- Cleans up `client.xcoms.set` in the Task SDK to use the simplified URL format.
closes: #70080
---
##### Was generative AI tooling used to co-author this PR?
- [x] Yes (please specify the tool below)
Generated-by: [Gemini] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Refactor xcom jwt url [airflow]
Posted by "SameerMesiah97 (via GitHub)" <gi...@apache.org>.
SameerMesiah97 commented on code in PR #70081:
URL: https://github.com/apache/airflow/pull/70081#discussion_r3609612928
##########
airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py:
##########
@@ -27,22 +27,20 @@
from airflow.api_fastapi.common.db.common import SessionDep
from airflow.api_fastapi.core_api.base import BaseModel
+from airflow.api_fastapi.execution_api.datamodels.token import TIToken
from airflow.api_fastapi.execution_api.datamodels.xcom import (
XComResponse,
XComSequenceIndexResponse,
XComSequenceSliceResponse,
)
from airflow.api_fastapi.execution_api.security import CurrentTIToken
+from airflow.models.taskinstance import TaskInstance
from airflow.models.taskmap import TaskMap
from airflow.models.xcom import XComModel
from airflow.utils.db import get_query_count
def has_xcom_access(
- dag_id: str,
- run_id: str,
- task_id: str,
- xcom_key: Annotated[str, Path(alias="key", min_length=1)],
Review Comment:
Changing the signature of a public API by removing required parameters breaks backwards compatibility. If you intend to deprecate them, it would better to turn these into optional parameters (with default arguments of `None`).
##########
airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py:
##########
@@ -359,15 +364,13 @@ def get_xcom(
# TODO: once we have JWT tokens, then remove dag_id/run_id/task_id from the URL and just use the info in
# the token
@router.post(
- "/{dag_id}/{run_id}/{task_id}/{key:path}",
+ "/{key:path}",
Review Comment:
I think it would be better to keep the existing route for backwards compatibility and add the new route with only `/{key:path}`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Refactor xcom jwt url [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil closed pull request #70081: Refactor xcom jwt url
URL: https://github.com/apache/airflow/pull/70081
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Refactor xcom jwt url [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on PR #70081:
URL: https://github.com/apache/airflow/pull/70081#issuecomment-5037344162
Please follow better guidelines for PR title !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org