You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "roshan-ramees (via GitHub)" <gi...@apache.org> on 2026/08/03 10:51:51 UTC
[PR] Implement FabAuthManager.refresh_user for sliding JWT refresh [airflow]
roshan-ramees opened a new pull request, #70980:
URL: https://github.com/apache/airflow/pull/70980
### What?
Implements `FabAuthManager.refresh_user` so `JWTRefreshMiddleware` reissues the `_token` cookie on every request when the user is authenticated.
### Why?
`JWTRefreshMiddleware` (added in #55506, 3.1.4) drives sliding-refresh of the UI JWT by calling `auth_manager.refresh_user(user)`. `BaseAuthManager.refresh_user` is a no-op by default. `KeycloakAuthManager` overrides it — `FabAuthManager` does not. On FAB deployments (the default), the silent-refresh path does nothing, so long-open browser tabs burst 401s from concurrent `/ui/*` and `/api/v2/*` polls every `[api_auth] jwt_expiration_time` interval.
Symptom on our prod (Airflow 3.1.7 + FAB + Google OAuth):
```
[error] JWT token is not valid: Signature has expired
[airflow.api_fastapi.auth.managers.base_auth_manager] loc=base_auth_manager.py:107
INFO: - "GET /ui/dashboard/dag_stats HTTP/1.1" 401 Unauthorized
INFO: - "GET /ui/dags?dag_runs_limit=14&limit=50&offset=0&exclude_stale=true&order_by=dag_display_name HTTP/1.1" 401 Unauthorized
INFO: - "GET /api/v2/dags/~/dagRuns/~/hitlDetails?state=deferred&response_received=false HTTP/1.1" 401 Unauthorized
```
Related open issue: #57065.
### How?
Return the current user for authenticated (non-anonymous) FAB sessions. `deserialize_user` above already re-fetches the user from DB by `token["sub"]`, so the object is fresh — returning it is safe and adds only one HS512 sign per request (sub-ms).
For anonymous / no user, return `None` to skip the reissue.
### Tests
Three unit tests covering: authenticated user → returns user; anonymous user → returns None; no user → returns None.
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the [Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines) for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, following [instructions located in the newsfragments README.rst](https://github.com/apache/airflow/blob/main/newsfragments/README.rst)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement FabAuthManager.refresh_user for sliding JWT refresh [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #70980: Implement FabAuthManager.refresh_user for sliding JWT refresh
URL: https://github.com/apache/airflow/pull/70980
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement FabAuthManager.refresh_user for sliding JWT refresh [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #70980:
URL: https://github.com/apache/airflow/pull/70980#issuecomment-5165407966
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement FabAuthManager.refresh_user for sliding JWT refresh [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #70980:
URL: https://github.com/apache/airflow/pull/70980#issuecomment-5824572265
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org