You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "srchilukoori (via GitHub)" <gi...@apache.org> on 2026/04/23 17:20:09 UTC
[PR] Fix DiscordWebhookHook leaking webhook_endpoint as HTTP header [airflow]
srchilukoori opened a new pull request, #65736:
URL: https://github.com/apache/airflow/pull/65736
## Description
`DiscordWebhookHook` stores `webhook_endpoint` in the connection's `extra` field (e.g. `{"webhook_endpoint": "webhooks/{id}/{token}"}`). `HttpHook._configure_session_from_extra` promotes all unrecognised extra fields to session headers after extracting known options (proxies, timeout, verify, etc.). As a result, every request to Discord included a spurious `webhook_endpoint` header, which Discord rejects with `400 Bad Request`.
The bug was introduced when `HttpHook` started treating leftover `extra` fields as headers (for generic HTTP auth/session customisation). The Discord hook needs to suppress this for its own connection-specific field.
Fixes #65279
## Changes
- `providers/discord/src/airflow/providers/discord/hooks/discord_webhook.py`: Override `get_conn()` in `DiscordWebhookHook` to pop `webhook_endpoint` from session headers after the parent builds the session.
- `providers/discord/tests/unit/discord/hooks/test_discord_webhook.py`: Add `test_get_conn_does_not_leak_webhook_endpoint_as_header` to assert the header is absent from the session.
## Root Cause
```python
# HttpHook._configure_session_from_extra (http/hooks/http.py)
# After popping stream/cert/proxies/timeout/verify/etc., remaining extra fields
# are added as session headers — including webhook_endpoint from Discord connections.
session.headers.update(conn_extra_options) # ← sends webhook_endpoint to Discord → 400
# Fix in DiscordWebhookHook
def get_conn(self, headers=None, extra_options=None):
session = super().get_conn(headers=headers, extra_options=extra_options)
# webhook_endpoint is a Discord connection field, not an HTTP header.
session.headers.pop("webhook_endpoint", None)
return session
```
---
##### Was generative AI tooling used to co-author this PR?
- [x] Yes Claude
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix DiscordWebhookHook leaking webhook_endpoint as HTTP header [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl merged PR #65736:
URL: https://github.com/apache/airflow/pull/65736
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix DiscordWebhookHook leaking webhook_endpoint as HTTP header [airflow]
Posted by "srchilukoori (via GitHub)" <gi...@apache.org>.
srchilukoori commented on PR #65736:
URL: https://github.com/apache/airflow/pull/65736#issuecomment-4306939786
@potiuk please review the PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix DiscordWebhookHook leaking webhook_endpoint as HTTP header [airflow]
Posted by "srchilukoori (via GitHub)" <gi...@apache.org>.
srchilukoori commented on PR #65736:
URL: https://github.com/apache/airflow/pull/65736#issuecomment-4330986141
@jscheffl if you got a minute please review this PR, please. (found you from a previous PR from the history of this file).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org