You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2020/12/01 21:19:00 UTC
[jira] [Commented] (AIRFLOW-2884) Fix Flask SECRET_KEY security
issue in www_rbac
[ https://issues.apache.org/jira/browse/AIRFLOW-2884?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17241880#comment-17241880 ]
ASF subversion and git services commented on AIRFLOW-2884:
----------------------------------------------------------
Commit 2d7d28a0d70909cdec336478c4658e42936ae61a in airflow's branch refs/heads/v1-10-test from Xiaodong Deng
[ https://gitbox.apache.org/repos/asf?p=airflow.git;h=2d7d28a ]
[AIRFLOW-2884] Fix Flask SECRET_KEY security issue in www_rbac (#3729)
The same issue was fixed for /www previously in
PR https://github.com/apache/incubator-airflow/pull/3651
(JIRA ticket 2809)
(cherry picked from commit fe6d00a54f83468e296777d3b83b65a2ae7169ec)
> Fix Flask SECRET_KEY security issue in www_rbac
> ------------------------------------------------
>
> Key: AIRFLOW-2884
> URL: https://issues.apache.org/jira/browse/AIRFLOW-2884
> Project: Apache Airflow
> Issue Type: Bug
> Components: ui
> Reporter: Xiaodong Deng
> Assignee: Xiaodong Deng
> Priority: Critical
> Labels: webapp
> Fix For: 2.0.0
>
>
> Flask secret key should be as random as possible, while it's not in Airflow Flask App.
> This issue was fixed for *www* in ticket https://issues.apache.org/jira/browse/AIRFLOW-2809 (merged in PR [https://github.com/apache/incubator-airflow/pull/3651)] .
> But this issue was not fixed for *www_rbac* yet.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)