[I] Refactor Execution API: Remove dag_id/run_id/task_id from XCom URL in favor of JWT token [airflow]

["KushagraB424 (via GitHub)" <gi...@apache.org>]

KushagraB424 opened a new issue, #70080:
URL: https://github.com/apache/airflow/issues/70080

   ### Description
   
   Currently, the `/execution/xcoms/{dag_id}/{run_id}/{task_id}/{key}` endpoint in the Execution API accepts the DAG ID, Run ID, and Task ID as URL parameters. 
   
   However, since the Task SDK now authenticates with the Execution API using a short-lived JWT token that is inherently scoped to the specific task instance, passing these identifiers in the URL is redundant and bypasses the zero-trust model. 
   
   An existing `TODO` in `xcoms.py` notes that we should remove these parameters from the URL and rely entirely on the information embedded in the JWT token (or looked up via the token ID).
   
   
   ### Use case/motivation
   
   - **Security**: Enforces that the worker can only set XComs for the exact task instance it is authorized for (zero-trust model).
   - **Simplicity**: Cleans up the URL structure and routing logic.
   - **Payload/Path Reduction**: Removes redundant path variables that the worker shouldn't have to explicitly specify anyway.
   
   
   ### Related issues
   
   _No response_
   
   ### Are you willing to submit a PR?
   
   - [x] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Refactor Execution API: Remove dag_id/run_id/task_id from XCom URL in favor of JWT token [airflow]

["shivaam (via GitHub)" <gi...@apache.org>]

shivaam commented on issue #70080:
URL: https://github.com/apache/airflow/issues/70080#issuecomment-5127203525

   I have started working on a compatible first slice for this issue. The plan is to keep the existing POST route for older Task SDK clients, validate its Dag/run/task/map identity against the TaskInstance identified by the JWT, and use the token-resolved identity for the write. I will keep the read-route source identifiers unchanged because cross-task, cross-Dag, historical, and mapped XCom pulls rely on them.
   
   I am testing matching and mismatched identities, mapped tasks, and retry behavior locally.
   
   ---
   Drafted-by: Codex (GPT-5) (no human review before posting)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org