You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "ashb (via GitHub)" <gi...@apache.org> on 2025/04/24 14:00:44 UTC
[PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
ashb opened a new pull request, #49721:
URL: https://github.com/apache/airflow/pull/49721
`api/ssl_cert` has a default value of "" so `has_option` is always returning
true, so we have to find in a slightly more complex way of telling if this
setting is turned on.
I have also updated the Simple security manager to look at X-Forwarded-Proto
so that if there is a reverse proxy in front (and if Airflow is configured to
trust that) then it sets the secure flag.
This PR only touches airflow core -- there will be another PR for fixing FAB
manager.
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828702374
@brechtvb which auth manager are you using? Did you try the other one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828678149
very odd - not working 2 times from scratch. I'm familiar with python and docker.
```
INFO: Waiting for application startup.
ERROR: Traceback (most recent call last):
File "/home/airflow/.local/lib/python3.12/site-packages/starlette/routing.py", line 692, in lifespan
async with self.lifespan_context(app) as maybe_state:
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
async with original_context(app) as maybe_original_state:
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
async with original_context(app) as maybe_original_state:
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/app.py", line 62, in lifespan
await stack.enter_async_context(
File "/usr/local/lib/python3.12/contextlib.py", line 659, in enter_async_context
result = await _enter(cm)
^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
async with original_context(app) as maybe_original_state:
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/svcs/fastapi.py", line 66, in __call__
async with self.registry, cm(app, self.registry) as state:
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
return await anext(self.gen)
^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/execution_api/app.py", line 93, in lifespan
registry.register_value(JWTValidator, _jwt_validator(), ping=JWTValidator.status)
^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/execution_api/app.py", line 64, in _jwt_validator
**get_sig_validation_args(make_secret_key_if_needed=False),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 578, in get_sig_validation_args
return {"secret_key": get_signing_key("api_auth", "jwt_secret", make_secret_key_if_needed)}
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 535, in get_signing_key
raise ValueError(f"The value {section}/{key} must be set!")
ValueError: The value api_auth/jwt_secret must be set!
ERROR: Application startup failed. Exiting.
INFO: Waiting for child process [352]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829901564
A possible work around for anyone eager to try out 3.0.0 before we get it released in 3.0.1:
```Dockerfile
FROM apache/airflow:3.0.0
USER root
RUN apt update && apt install -y patch patchutils
RUN set -ex; \
cd /home/airflow/.local/lib/python3.12/site-packages/airflow; \
curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49721.patch \
| filterdiff -p1 -i 'airflow-core/src/airflow/*' | patch -p4 -u --verbose
USER airflow
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2893707656
> > Maybe off topic:
> > Is the docker compose deployment deemed fit for production environments?
>
> Nope, check https://airflow.apache.org/docs/apache-airflow/stable/howto/docker-compose/index.html#:~:text=This%20procedure%20can,Airflow%20in%20production. to know why :)
But this link talks about production docker images
https://airflow.apache.org/docs/apache-airflow/stable/installation/index.html#using-production-docker-images
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829962386
@brechtvb What Auth Manager are you using? What are the URLs you get redirected through please?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "diegoscarabelli (via GitHub)" <gi...@apache.org>.
diegoscarabelli commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2861889278
@ashb With your solution for FAb auth manager, I am finding this error applying the second patch:
` [airflow-init 5/5] RUN set -ex; cd /home/airflow/.local/lib/python3.12/site-packages/airflow; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49721.patch | filterdiff -p1 -i 'airflow-core/src/airflow/*' | patch -p4 -u --verbose; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49724.patch | patch -p5 -u --verbose; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49581.patch | filterdiff -p1 -i 'providers/fab/src/airflow/*' | patch -p5 -u --verbose:
0.128 + cd /home/airflow/.local/lib/python3.12/site-packages/airflow
0.128 + curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49721.patch
0.128 + filterdiff -p1 -i 'airflow-core/src/airflow/*'
0.128 + patch -p4 -u --verbose
0.132 % Total % Received % Xferd Average Speed Time Time Time Current
0.132 Dload Upload Total Spent Left Speed
100 2879 100 2879 0 0 8448 0 --:--:-- --:--:-- --:--:-- 8467
0.474 Hmm... Looks like a unified diff to me...
0.474 The text leading up to this was:
0.474 --------------------------
0.474 |diff --git a/airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py b/airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py
0.474 |index c901692d8f9c8..82875ceb1239c 100644
0.474 |--- a/airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py
0.474 |+++ b/airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py
0.474 --------------------------
0.490 patching file api_fastapi/auth/managers/simple/routes/login.py
0.490 Using Plan A...
0.490 Hunk #1 succeeded at 17.
0.490 Hunk #2 succeeded at 57.
0.490 done
0.490 + curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49724.patch
0.490 + patch -p5 -u --verbose
0.499 % Total % Received % Xferd Average Speed Time Time Time Current
0.499 Dload Upload Total Spent Left Speed
100 9270 100 9270 0 0 29393 0 --:--:-- --:--:-- --:--:-- 29428
0.817 Hmm... I can't seem to find a patch in there anywhere.
0.817 patch: **** Only garbage was found in the patch input.
------
failed to solve: process "/bin/bash -o pipefail -o errexit -o nounset -o nolog -c set -ex; cd /home/airflow/.local/lib/python3.12/site-packages/airflow; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49721.patch | filterdiff -p1 -i 'airflow-core/src/airflow/*' | patch -p4 -u --verbose; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49724.patch | patch -p5 -u --verbose; curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49581.patch | filterdiff -p1 -i 'providers/fab/src/airflow/*' | patch -p5 -u --verbose" did not complete successfully: exit code: 2`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2861894464
@diegoscarabelli can you try 3.0.1-rc1 and see if the problem is fixed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828716229
i just use this: https://airflow.apache.org/docs/apache-airflow/3.0.0/docker-compose.yaml
and modified the airflow container as the diff describes, then committed that to (local) tag: 3.0.0-fixed
and updated that in the docker-compose.yaml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828235953
> can this be manually applied on a 3.0.0 with docker-compose?
Yes it can. One has to edit the image (spin up a container, access it via the cli, apply the diff, exit the container, commit), then modify docker-compose if the image name was changes, and re-run.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828696303
yes, so i used the docker-compose setup and i do this:
`docker compose down --volumes --remove-orphans`
i make sure all previous containers are gone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828809389
@vincbeck that would be odd - it is nowhere mentioned in the deployment docs.
All i did was fixing the infinite loop redirect in the docker container.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2827978232
### Backport successfully created: v3-0-test
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-0-test</td>
<td><a href="https://github.com/apache/airflow/pull/49733"><img src="https://img.shields.io/badge/PR-49733-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "diegoscarabelli (via GitHub)" <gi...@apache.org>.
diegoscarabelli commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2863690584
> @diegoscarabelli can you try 3.0.1-rc1 and see if the problem is fixed?
Yes, 3.0.1rc1 works. Hopefully becomes official soon. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "gtsiatsios (via GitHub)" <gi...@apache.org>.
gtsiatsios commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2865629495
> https://airflow.apache.org/docs/apache-airflow/stable/howto/docker-compose/index.html#:~:text=This%20procedure%20can,Airflow%20in%20production
The second link is no longer existing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828373190
@Dev-iL i tried to do so, i can modify the py file, but i have no idea where to find the .rst file.
when only modifying the .py file, the `docker-airflow-apiserver` fails to boot
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829975125
Very sorry, the black boxes is the hostname (no domain included):
is this a networking problem on my side.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828753694
> very odd - not working 2 times from scratch. I'm familiar with python and docker.
>
> when running `python login.py` (the to be modified file) there were no messages or errors, so syntax was fine.
>
> ```
> INFO: Waiting for application startup.
> ERROR: Traceback (most recent call last):
> File "/home/airflow/.local/lib/python3.12/site-packages/starlette/routing.py", line 692, in lifespan
> async with self.lifespan_context(app) as maybe_state:
> ^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
> async with original_context(app) as maybe_original_state:
> ^^^^^^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
> async with original_context(app) as maybe_original_state:
> ^^^^^^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/app.py", line 62, in lifespan
> await stack.enter_async_context(
> File "/usr/local/lib/python3.12/contextlib.py", line 659, in enter_async_context
> result = await _enter(cm)
> ^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/routing.py", line 133, in merged_lifespan
> async with original_context(app) as maybe_original_state:
> ^^^^^^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/svcs/fastapi.py", line 66, in __call__
> async with self.registry, cm(app, self.registry) as state:
> ^^^^^^^^^^^^^^^^^^^^^^
> File "/usr/local/lib/python3.12/contextlib.py", line 210, in __aenter__
> return await anext(self.gen)
> ^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/execution_api/app.py", line 93, in lifespan
> registry.register_value(JWTValidator, _jwt_validator(), ping=JWTValidator.status)
> ^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/execution_api/app.py", line 64, in _jwt_validator
> **get_sig_validation_args(make_secret_key_if_needed=False),
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 578, in get_sig_validation_args
> return {"secret_key": get_signing_key("api_auth", "jwt_secret", make_secret_key_if_needed)}
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/tokens.py", line 535, in get_signing_key
> raise ValueError(f"The value {section}/{key} must be set!")
> ValueError: The value api_auth/jwt_secret must be set!
>
> ERROR: Application startup failed. Exiting.
> INFO: Waiting for child process [352]
> ```
Looking at the error message you need to set the config `[api_auth] jwt_secret`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828689722
@brechtvb does this happen with a clean, or a migrated db? Did you prune volumes in between attempts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "sopanawit (via GitHub)" <gi...@apache.org>.
sopanawit commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2862227528
> @diegoscarabelli can you try 3.0.1-rc1 and see if the problem is fixed?
I tried this version in my docker compose file and confirmed it worked!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "gtsiatsios (via GitHub)" <gi...@apache.org>.
gtsiatsios commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2865677720
Trying to use `3.0.1-rc1` in Docker-compose but I get
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2863811240
> Maybe off topic:
>
> Is the docker compose deployment deemed fit for production environments?
Nope, check https://airflow.apache.org/docs/apache-airflow/stable/howto/docker-compose/index.html#:~:text=This%20procedure%20can,Airflow%20in%20production. to know why
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828380679
@brechtvb disregard that one, it's just docs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829977945
If you are using the FAB auth manger, then you will need the patch for #49724 too:
```Dockerfile
FROM apache/airflow:3.0.0
USER root
RUN apt update && apt install -y patch patchutils
RUN set -ex; \
cd /home/airflow/.local/lib/python3.12/site-packages/airflow; \
curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49721.patch \
| filterdiff -p1 -i 'airflow-core/src/airflow/*' | patch -p4 -u --verbose; \
curl https://patch-diff.githubusercontent.com/raw/apache/airflow/pull/49724.patch \
| patch -p5 -u --verbose
USER airflow
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "Dev-iL (via GitHub)" <gi...@apache.org>.
Dev-iL commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2827825531
I can confirm that the change to the simple auth manager works with docker!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2828226676
can this be manually applied on a 3.0.0 with docker-compose?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb merged PR #49721:
URL: https://github.com/apache/airflow/pull/49721
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829996992
@ashb it'w working! thank you very much.
i believe there is small typo, the double `/`
`providers/fab//src/airflow`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2829957391
This does not fix it for me - i guess i'm doing something wrong.
new container listed & updated in the docker-compose.yaml (to use the new one)
```
REPOSITORY TAG IMAGE ID CREATED SIZE
apache/airflow 3.0.0-fixed 36a65204eca0 15 minutes ago 1.83GB
apache/airflow 3.0.0 07fc276fd638 2 days ago 1.8GB
```
` image: ${AIRFLOW_IMAGE_NAME:-apache/airflow:3.0.0-fixed}`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "brechtvb (via GitHub)" <gi...@apache.org>.
brechtvb commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2863800398
Maybe off topic:
Is the docker compose deployment deemed fit for production environments?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix infinite redirect caused by mistakenly setting token cookie as secure [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on PR #49721:
URL: https://github.com/apache/airflow/pull/49721#issuecomment-2863751912
> > @diegoscarabelli can you try 3.0.1-rc1 and see if the problem is fixed?
>
> Yes, 3.0.1rc1 works. Hopefully becomes official soon. Thanks!
Yup, next Monday (12 May) is a likely date
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org