You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "shan-zeeshan786 (via GitHub)" <gi...@apache.org> on 2026/04/16 21:12:35 UTC
[I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
shan-zeeshan786 opened a new issue, #65391:
URL: https://github.com/apache/airflow/issues/65391
### Under which category would you file this issue?
Airflow Core
### Apache Airflow version
3.2.0
### What happened and how to reproduce it?
Recently, we changed the Fernet key in our environment. After this change, we started observing 500 Internal Server Errors when accessing Variables via the Stable REST API.
API Call:
GET /api/v1/variables/{key}
**Request:**
curl -X GET "http://<- airflow-webserver ->/api/v1/variables/<- variable_name ->" \
-H "accept: application/json" \
-H "Authorization: Basic <base64-credentials>"
**Response:**
{
"detail": "None is not of type 'string'\n\nFailed validating 'type' in schema['allOf'][1]['properties']['value']:\n{'type': 'string'}\n\nOn instance['value']:\n None",
"status": 500,
"title": "Response body does not conform to specification",
"type": "https://airflow.apache.org/docs/apache-airflow/3.2.0/stable-rest-api-ref.html#section/Errors/Unknown"
}
### What you think should happen instead?
The API should handle undecryptable Variable values gracefully instead of returning a 500 error.
Possible expected behaviors:
- Return a 200 response with value as null or masked
- OR return a clear 4xx error indicating decryption failure
- OR include a meaningful error message (e.g., "Unable to decrypt variable with current Fernet key")
At minimum, the response should not violate the OpenAPI schema and should not result in a 500 Internal Server Error.
### Operating System
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/"
### Deployment
Official Apache Airflow Helm Chart
### Apache Airflow Provider(s)
_No response_
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
Not Applicable
### Kubernetes Version
Not Applicable
### Helm Chart configuration
Not Applicable
### Docker Image customizations
Not Applicable
### Anything else?
_No response_
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "shan-zeeshan786 (via GitHub)" <gi...@apache.org>.
shan-zeeshan786 commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-4268621413
I understand your point @potiuk about 500 representing unexpected internal errors, and I agree that misconfigured Fernet keys fall into that category and should not normally happen in a properly managed deployment.
However, my concern here is more about API consistency and behavior across endpoints, rather than strictly changing the HTTP status code.
Currently, there is an inconsistency in how the Variables API behaves:
1. The **List Variables API**
(/api/v2/variables) returns the variables successfully, but with values as null when decryption fails.
2. The **Get Variable API**
(/api/v2/variables/{key}) returns a 500 Internal Server Error for the same scenario.
Because both APIs are accessing the same underlying data and encountering the same decryption issue, the difference in behavior makes the API inconsistent and harder to handle from a client perspective.
The intention is to synchronize the APIs’ behavior by aligning the Get Variable API with the List Variables API. Specifically, when decryption fails, the API should return a response with value as Null:
**List api output:**
{
"total_entries": 1,
"variables": [
{
"description": "Testing variable use",
"key": "Testing",
"value": null
}
]
}
**Expected output:**
{
"description": "Testing variable use",
"key": "Testing",
"value": null
}
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "shan-zeeshan786 (via GitHub)" <gi...@apache.org>.
shan-zeeshan786 commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-4272012174
Thanks @potiuk ! I understand your perspective that this isn’t really an issue. I just wanna proceed with a PR as a small improvement for consistency across the APIs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-4264371680
To be honest, it's not really wrong. 500 means that there is an internal errors and you can **always** receive it - you should never declare something that is - by definition - an unexpected error. If it is "unexpected" error, by definition you do not expect it to be returned. So no violation of Open API spec happens here.
Changing fernet key without rotating it properly is quite, well, unexpected. And it leaves the system in generally unusable state that should not happen at all if you have your deployment processes in order. And especially if the log is written on the server side explaining what happens. There are certain errors that you do not even want to expose because of security - for example if we provide a meaningul message as response in this case, potential attacker could find out you have misconfiured database with probably old data still encrypted with old fernet key, possibly because it's been leaked, which might give attacker a clue that grabbing your database dump now is a good idea, because someone has a stolen key. Hypothetical, but possible scenario.
S o I am not sure what other HTTP error you would like to propose @shan-zeeshan786 ? Which of the "expected" HTTP errors you would like to see without leaking that you made mistake (re)configuring your installation ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi closed issue #65391: Stable REST API returns 500 error for Variables when Fernet key is changed
URL: https://github.com/apache/airflow/issues/65391
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-4271579987
Feel free to make PR implementing it. I don't see it as an issue - but if you feel like this could be improved - feel absolutely free.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "shan-zeeshan786 (via GitHub)" <gi...@apache.org>.
shan-zeeshan786 commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-4263723216
Thank you for the guidance.I’m happy to take this up and will raise a PR to address the issue soon.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Stable REST API returns 500 error for Variables when Fernet key is changed [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on issue #65391:
URL: https://github.com/apache/airflow/issues/65391#issuecomment-5511172404
Closed by https://github.com/apache/airflow/pull/65452
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org