You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Subham-KRLX (via GitHub)" <gi...@apache.org> on 2026/01/05 14:48:35 UTC
[I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Subham-KRLX opened a new issue, #60125:
URL: https://github.com/apache/airflow/issues/60125
### Description
The Execution API has authentication but no authorization - tasks can access ANY variable, connection, or XCom. Three TODO placeholders need implementation to enforce team-based access control.
### Use case/motivation
**Security Problem:** Any authenticated task can currently access resources from any team because [has_variable_access()](cci:1://file:///Users/subhamsangwan/airflow/airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py:32:0-46:15), [has_connection_access()](cci:1://file:///Users/subhamsangwan/airflow/airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py:29:0-41:15), and [has_xcom_access()](cci:1://file:///Users/subhamsangwan/airflow/airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py:40:0-59:15) always return True.
**What I want to achieve:**
- Tasks should only access variables/connections from their DAG's team
- Tasks should only access XComs from their own DAG run
- Proper authorization checks in Execution API (similar to Core API)
**Affected files:**
- `airflow/api_fastapi/execution_api/routes/variables.py:40`
- `airflow/api_fastapi/execution_api/routes/connections.py:35`
- `airflow/api_fastapi/execution_api/routes/xcoms.py:50`
**Proposed solution:**
1. Extract task's DAG from JWT token
2. Verify resource's team matches DAG's team
3. Allow global resources (no team)
4. Backward compatible with feature flag
**Benefits:**
- Security: Resource isolation
- Multi-team: Team boundaries enforced
- Compliance: Audit trail for access
### Related issues
No
### Are you willing to submit a PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "anishgirianish (via GitHub)" <gi...@apache.org>.
anishgirianish commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3931971834
Hi, I would like to work on a design proposal if this is still open. thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3712218766
Yes. That was long time planned - if you want to take a look at that - feel free, but this should be definitely preceded a proposal describing security model you want to propose and discussing it on devlist. It's not a matter of **just** PR but thorough discussion and deliberate design.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "anishgirianish (via GitHub)" <gi...@apache.org>.
anishgirianish commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3936734647
Thanks @Subham-KRLX! I've already sent a design proposal to the dev mailing list, and it's been reviewed. You can see it here:
https://www.mail-archive.com/dev@airflow.apache.org/msg21084.html
I'll be raising the PRs shortly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3986418174
@Subham-KRLX We are unassigning you from this issue as part of our updated [assignment policy](https://github.com/apache/airflow/blob/main/contributing-docs/04_how_to_contribute.rst#contribute-code-changes).
This is not meant to discourage your contribution — quite the opposite! You are still very welcome to work on this issue and submit a PR for it. Simply comment that you are working on it and open a PR when ready.
We found that formal assignments were not working well, as they often prevented others from contributing when the assignee was not actively working on the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3710742502
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Implement access control for Execution API (variables, connections, XComs) [airflow]
Posted by "Subham-KRLX (via GitHub)" <gi...@apache.org>.
Subham-KRLX commented on issue #60125:
URL: https://github.com/apache/airflow/issues/60125#issuecomment-3933710399
@anishgirianish feel free to start working on this and raise a PR! I am also looking into it and drafting the design proposal for the devlist as @potiuk suggested Let's coordinate there to make sure we are aligned on the security model.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org