You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@airflow.apache.org by "Vamsi-klu (via GitHub)" <gi...@apache.org> on 2026/03/01 07:27:41 UTC

[PR] Make CORS allow_credentials configurable instead of hardcoded True [airflow]

Vamsi-klu opened a new pull request, #62658:
URL: https://github.com/apache/airflow/pull/62658

   ## Summary
   - Replace hardcoded `allow_credentials=True` in CORSMiddleware with configurable `[api] access_control_allow_credentials` option (default: `False`)
   - Log a warning when `allow_credentials=True` is used with wildcard (`*`) origins, as this creates CSRF risk
   - Add config option to `config.yml` template
   
   ## Test plan
   - [ ] Verify default behavior: `allow_credentials=False` when option not set
   - [ ] Verify setting `access_control_allow_credentials = True` enables credentials
   - [ ] Verify warning is logged when credentials + wildcard origins are configured
   - [ ] Run `pytest tests/api_fastapi/core_api/test_app.py -v`
   
   **Note:** This is a breaking change for deployments that rely on CORS credentials being enabled by default.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Make CORS allow_credentials configurable instead of hardcoded True [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

potiuk commented on PR #62658:
URL: https://github.com/apache/airflow/pull/62658#issuecomment-4179005353

@Vamsi-klu This PR has been converted to **draft** because it does not yet meet our [Pull Request quality criteria](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-quality-criteria).

**Issues found:**
- :x: **Failing CI checks**: CI checks are failing (individual check names not available). Run `prek run --from-ref main` locally to reproduce. See [static checks docs](https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst) and [testing docs](https://github.com/apache/airflow/blob/main/contributing-docs/09_testing.rst).

> **Note:** Your branch is **984 commits behind `main`**. Some check failures may be caused by changes in the base branch rather than by your PR. Please rebase your branch and push again to get up-to-date CI results.

**What to do next:**
- The comment informs you what you need to do.
- Fix each issue, then mark the PR as "Ready for review" in the GitHub UI - but only after making sure that all the issues are fixed.
- There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates.
- Maintainers will then proceed with a normal review.

Converting a PR to draft is **not** a rejection — it is an invitation to bring the PR up to the project's standards so that maintainer review time is spent productively. There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates. If you have questions, feel free to ask on the [Airflow Slack](https://s.apache.org/airflow-slack).

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Make CORS allow_credentials configurable instead of hardcoded True [airflow]

Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.

pierrejeambrun closed pull request #62658: Make CORS allow_credentials configurable instead of hardcoded True
URL: https://github.com/apache/airflow/pull/62658


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Make CORS allow_credentials configurable instead of hardcoded True [airflow]

Posted by "Vamsi-klu (via GitHub)" <gi...@apache.org>.

Vamsi-klu commented on PR #62658:
URL: https://github.com/apache/airflow/pull/62658#issuecomment-3979421447

   cc @kaxil @vincbeck @ashb — Would appreciate your review. This replaces the hardcoded `allow_credentials=True` in CORSMiddleware with a configurable option (default: `False`). Note this is a breaking change for deployments relying on CORS credentials being enabled by default.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org