You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "LipuFei (via GitHub)" <gi...@apache.org> on 2025/07/19 16:04:36 UTC
[PR] fix: Add missing security settings for session cookie [airflow]
LipuFei opened a new pull request, #53542:
URL: https://github.com/apache/airflow/pull/53542
Add the following security-related session cookie settings that was missing:
- `SESSION_COOKIE_HTTPONLY = True`
- `SESSION_COOKIE_SECURE` comes from config `[webserver] COOKIE_SECURE`
- `SESSION_COOKIE_SAMESITE` comes from config `[webserver] COOKIE_SAMESITE`
We may want to change the config location because this is now in api-server in 3.0?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "snowsky (via GitHub)" <gi...@apache.org>.
snowsky commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3661326198
Will this fix be included in the next release? Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "snowsky (via GitHub)" <gi...@apache.org>.
snowsky commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3672548312
> > Will this fix be included in the next release? Thanks!
>
> It is mostly a provider change so this is already released in the latest fab provider version
Is this env var still valid `AIRFLOW__WEBSERVER__COOKIE_SECURE`? I saw it was introduced in version 1.3 but didn't find it in version 3 docs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #53542:
URL: https://github.com/apache/airflow/pull/53542
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "LipuFei (via GitHub)" <gi...@apache.org>.
LipuFei commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3136675162
> > > We marked these configs as deleted in `airflow-ctl/src/airflowctl/ctl/commands/config_command.py`. If we want to use them back, we should them remove them from `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` as well.
> >
> > Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.
> >
> > Perhaps you know a better way to have them configured in api-server in 3.0?
> >
> > I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.
>
> You are using these config so you need them back and I think this is okay. You are using these configs `conf.getboolean("webserver", "COOKIE_SECURE")` and `conf.get("webserver", "COOKIE_SAMESITE")`. I think the right approach would be to move these config to Fab provider because they are specific to Fab. Once done you would need to update `airflow-core/src/airflow/cli/commands/config_command.py` and `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` to no longer mark them as deleted but moved from `webserver` to `fab`. This [PR](https://github.com/apache/airflow/pull/50056) is a good example on how to do that.
Thank you. I will check that PR and update my changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3136667236
> > We marked these configs as deleted in `airflow-ctl/src/airflowctl/ctl/commands/config_command.py`. If we want to use them back, we should them remove them from `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` as well.
>
> Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.
>
> Perhaps you know a better way to have them configured in api-server in 3.0?
>
> I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.
You are using these config so you need them back and I think this is okay. You are using these configs `conf.getboolean("webserver", "COOKIE_SECURE")` and `conf.get("webserver", "COOKIE_SAMESITE")`. I think the right approach would be to move these config to Fab provider because they are specific to Fab. Once done you would need to update `airflow-core/src/airflow/cli/commands/config_command.py` and `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` to no longer mark them as deleted but moved from `webserver` to `fab`. This [PR](https://github.com/apache/airflow/pull/50056) is a good example on how to do that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3661460524
> Will this fix be included in the next release? Thanks!
It is mostly a provider change so this is already released in the latest fab provider version
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3097025853
We marked these configs as deleted in `airflow-ctl/src/airflowctl/ctl/commands/config_command.py`. If we want to use them back, we should them remove them from `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "LipuFei (via GitHub)" <gi...@apache.org>.
LipuFei commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3104823764
> We marked these configs as deleted in `airflow-ctl/src/airflowctl/ctl/commands/config_command.py`. If we want to use them back, we should them remove them from `airflow-ctl/src/airflowctl/ctl/commands/config_command.py` as well.
Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.
Perhaps you know a better way to have them configured in api-server in 3.0?
I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Add missing security settings for session cookie [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #53542:
URL: https://github.com/apache/airflow/pull/53542#issuecomment-3710754879
It is now `AIRFLOW__FAB__COOKIE_SECURE`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org