You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "stegololz (via GitHub)" <gi...@apache.org> on 2026/10/20 14:05:58 UTC
[PR] Keep the token cookie set by a route in JWTRefreshMiddleware [airflow]
stegololz opened a new pull request, #75217:
URL: https://github.com/apache/airflow/pull/75217
`JWTRefreshMiddleware` appends its own `_token` `Set-Cookie` header after the response headers. When the route has already set `_token` itself, browsers apply the headers in order, so the middleware's cookie overrides the route's cookie:
- **Login undone.** An auth manager login route (e.g. a callback under `/auth`) sets a fresh `_token`, but the request still carries an expired, revoked or otherwise invalid one. `resolve_user_from_token` fails, the middleware appends `_token=""; Max-Age=0` after the fresh cookie, and the user is logged out right after logging in.
- **Logout undone.** `/api/v2/auth/logout` revokes the presented tokens and deletes the cookie. But if `refresh_user` returned a user for that same request, the middleware mints a new token before the route runs. It then appends that token after the route's deletion. The new token was never revoked, so the user stays logged in.
The Keycloak provider already works around the login case in its own middleware (`request.state.jwt_token_issued`). That only helps Keycloak's login route, not other auth managers and not the logout case.
**Fix:** in `send_with_cookies`, skip the middleware's `_token` cookie when the response already sets `_token`. The cleanup of a stale root-path `_token` (#64955) is still appended, because it targets a different path.
**Tests:** three new tests in `test_refresh_token.py`, which fail without the fix:
- an invalid token on a request whose route sets `_token`: only the route's cookie is sent
- a refreshed user on the logout route: only the deletion is sent, no new token
- with a sub-path cookie path, the route's token is kept and the stale root cookie is still cleared
Related: #74722, #70783 and #70707 touch the same middleware; this change is independent of them.
---
##### Was generative AI tooling used to co-author this PR?
- [x] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep the token cookie set by a route in JWTRefreshMiddleware [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #75217:
URL: https://github.com/apache/airflow/pull/75217
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep the token cookie set by a route in JWTRefreshMiddleware [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #75217:
URL: https://github.com/apache/airflow/pull/75217#issuecomment-6336997146
### Backport failed to create: v3-4-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/39752474941'> Run details </a>
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>v3-4-test</td>
<td><a href="https://github.com/apache/airflow/commit/99eff4608f9a63874bf6f0efda845abeaa91d2d1"><img src='https://img.shields.io/badge/Commit-99eff46-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker 99eff46 v3-4-test
```
This should apply the commit to the v3-4-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
If you don't have cherry-picker installed, see the [installation guide](https://github.com/apache/airflow/blob/main/dev/README.md#how-to-backport-pr-with-cherry-picker-cli).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep the token cookie set by a route in JWTRefreshMiddleware [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #75217:
URL: https://github.com/apache/airflow/pull/75217#issuecomment-6362899652
### Backport successfully created: v3-4-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-4-test</td>
<td><a href="https://github.com/apache/airflow/pull/75454"><img src="https://img.shields.io/badge/PR-75454-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org