You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2025/12/27 23:36:14 UTC
[I] Never expose sensitive config values in UI [airflow]
potiuk opened a new issue, #59860:
URL: https://github.com/apache/airflow/issues/59860
### Body
Currently the `expose config` allows deployment manager to expose also sensitive data - when set to True https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#expose-config. The `non-sensitive-only` value causes sensitive field masking.
With the discussion mentioned in #59838 we agreed that we should **never** expose sensitive data over any public API where UI user can authenticate (only via task-sdk API where tasks get dedicated JWT token)
This means that:
* Only `True/False` should be expected for expose-config and `True` means that sensitive fields are masked
* We should add fallback - when "non-sensitive-data" is set for the parameter it should be treated as `True` and deprecation warning should be raised
* newsfragment should be added explaining the behaviour change
### Committer
- [x] I acknowledge that I am a maintainer/committer of the Apache Airflow project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "andreahlert (via GitHub)" <gi...@apache.org>.
andreahlert commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-3998080458
Closed by PR #59880 (merged 2026-01-03). Sensitive config values are now always masked in public APIs; expose_config accepts only True/False; non-sensitive-only is treated as True with deprecation warning.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "vatsrahul1001 (via GitHub)" <gi...@apache.org>.
vatsrahul1001 closed issue #59860: Never expose sensitive config values in UI
URL: https://github.com/apache/airflow/issues/59860
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "yjaw (via GitHub)" <gi...@apache.org>.
yjaw commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-3939094516
Should this issue be closed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-3986419008
@pratyush0325 We are unassigning you from this issue as part of our updated [assignment policy](https://github.com/apache/airflow/blob/main/contributing-docs/04_how_to_contribute.rst#contribute-code-changes).
This is not meant to discourage your contribution — quite the opposite! You are still very welcome to work on this issue and submit a PR for it. Simply comment that you are working on it and open a PR when ready.
We found that formal assignments were not working well, as they often prevented others from contributing when the assignee was not actively working on the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-3694696407
feel free
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "pratyush0325 (via GitHub)" <gi...@apache.org>.
pratyush0325 commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-3694601922
Hi @potiuk, I’m a new contributor and would like to work on this issue if it’s still available. I’ll follow up with a PR soon.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Never expose sensitive config values in UI [airflow]
Posted by "vatsrahul1001 (via GitHub)" <gi...@apache.org>.
vatsrahul1001 commented on issue #59860:
URL: https://github.com/apache/airflow/issues/59860#issuecomment-4738529604
Closing this as this is done in https://github.com/apache/airflow/pull/59880
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org