Re: [I] Revisit Secure token attribute [airflow]

["pierrejeambrun (via GitHub)" <gi...@apache.org>]

pierrejeambrun commented on issue #47878:
URL: https://github.com/apache/airflow/issues/47878#issuecomment-4798503279

   Update:
     The fixed pattern (proxy-aware) is:
     `secure = request.base_url.scheme == "https" or bool(conf.get("api", "ssl_cert", fallback=""))`
     request.base_url.scheme resolves to https behind a TLS-terminating proxy because gunicorn is
     started with forwarded_allow_ips="*" when proxy_headers is on (gunicorn_app.py:290). So where
     this is used, the issue is addressed.
   
   
     ✅ Done (request-scheme-aware):
     - airflow-core — simple/routes/login.py:96, auth/middlewares/refresh_token.py:72,
     core_api/routes/public/auth.py:71
     - FAB — fab/auth_manager/api_fastapi/routes/login.py:106 and the legacy Flask
     fab/www/views.py:122
     - Keycloak — only logout_callback (the cookie delete, line 158)
   
     ❌ Not done (still secure = bool(conf.get("api","ssl_cert")), cert-only):
     - Keycloak login → _oauth_state cookie (routes/login.py:68)
     - Keycloak login_callback → the actual session cookies, JWT + _id_token (routes/login.py:108)
     - AWS login_callback → JWT cookie (aws/auth_manager/routes/login.py:121)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org